diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index efaabac698..d1383c70a5 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -59,3 +59,25 @@ tags: - _time risk_severity: high security_domain: endpoint + message: Mimikatz malware is violating authentication processes by injecting golden or silver Kerberos tickets or passing stolen authentication tokens. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 90 + impact: 90 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others + diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 0edf2413a8..041866bf79 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -63,3 +63,25 @@ tags: - _time risk_severity: high security_domain: endpoint + message: PowerSploit malware is violating authentication by injecting stolen credentials, manipulating authentication tokens or impersonating system or user accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 90 + impact: 90 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others + diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index ef3b8ca23f..a84175c192 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -51,3 +51,25 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: DSInternals tool kit is assessing password strength at the device $dest_device_id$. Account attempting this operation is $dest_user_id$ via command $cmd_line$ + risk_score: 25 + impact: 30 + confidence: 85 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 7060d57c81..6ffcf3299d 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -50,3 +50,24 @@ tags: - process risk_severity: low security_domain: endpoint + message: Malicious actor is dumping stored credentials from the registry sections SAM, Security, or System. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 63 + impact: 70 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index be4891eb36..82b572e2e9 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -62,3 +62,24 @@ tags: - process risk_severity: high security_domain: endpoint + message: DSInternals tool kit is converting stolen credential material to a form applicable to authentications. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 70 + impact: 70 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index 8ba44c030c..e974f6ce0b 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -63,3 +63,24 @@ tags: - process risk_severity: high security_domain: endpoint + message: DSInternals tool kit is accessing sensitive credential material such as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 70 + impact: 70 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others \ No newline at end of file diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 5020198419..96a4a44fe3 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -59,3 +59,25 @@ tags: - process risk_severity: high security_domain: endpoint + message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 70 + impact: 70 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others + diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index eb45d0fdbe..3ac340130d 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -56,3 +56,24 @@ tags: - process risk_severity: high security_domain: endpoint + message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 63 + impact: 70 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index 07a215f813..405369c2cd 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -51,3 +51,24 @@ tags: - _time risk_severity: high security_domain: endpoint + message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 63 + impact: 70 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index 310c3d3451..a7bc8d3414 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -50,3 +50,24 @@ tags: - _time risk_severity: high security_domain: endpoint + message: Lazagne malware is extracting/decoding encoded credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 63 + impact: 70 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index fb0480edd7..8a8998b735 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -55,3 +55,24 @@ tags: - _time risk_severity: high security_domain: endpoint + message: Mimikatz malware is extracting/decoding encoded credentials from stores such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 66 + impact: 70 + confidence: 95 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index 7af6824cab..5eb1df47d0 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -60,3 +60,24 @@ tags: - process risk_severity: medium security_domain: endpoint + message: Malicious actor is extracting/decoding encoded credentials via Microsoft's native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 63 + impact: 70 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index 77fbcd6086..883e6cee55 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -56,3 +56,24 @@ tags: - process risk_severity: medium security_domain: endpoint + message: Malicious actor is extracting/decoding encoded credentials via Microsoft's native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 63 + impact: 70 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index d274bb7c10..5c62a516f5 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -56,3 +56,24 @@ tags: - _time risk_severity: high security_domain: endpoint + message: PowerSploit malware is extracting encoded credentials or spoofing automated logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 70 + impact: 70 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index 41b7ab42d3..b9a215118f 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -46,3 +46,24 @@ tags: - process risk_severity: low security_domain: endpoint + message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 70 + impact: 70 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index d3e9b66c8e..4417bb1ec9 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -51,3 +51,24 @@ tags: - ticket_options risk_severity: low security_domain: endpoint + message: Kerberoasting malware is potentially applying stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 14 + impact: 70 + confidence: 20 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index 2106acfe2c..dda061b9ad 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -56,3 +56,24 @@ tags: - dest_device_id risk_severity: low security_domain: endpoint + message: Potential use of the pass the hash/token attacks that spoof authentication. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 16 + impact: 80 + confidence: 20 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index 8c6486b9d0..e10388debc 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -55,3 +55,27 @@ tags: - _time risk_severity: high security_domain: endpoint + message: PowerSploit malware is tapping into user content - microphone, camera, ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 85 + impact: 85 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Exfiltration + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others + diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 62a86f1de0..9da325838c 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -48,3 +48,26 @@ tags: - _time risk_severity: high security_domain: endpoint + message: PowerSploit malware is creating illegal domain accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 80 + impact: 80 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Persistence + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others + diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 2d1488292f..253b15a350 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -50,3 +50,25 @@ tags: - _time risk_severity: high security_domain: endpoint + message: DSInternals malware is illegally enabling or disabling accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 80 + impact: 80 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index 71b200be15..da12028408 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -48,3 +48,25 @@ tags: - _time risk_severity: high security_domain: endpoint + message: Mimikatz malware is deleting event logs to cover tracks of malicious activity. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 50 + impact: 50 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index 599ae7b076..506609d587 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -53,3 +53,25 @@ tags: - _time risk_severity: high security_domain: endpoint + message: DSInternals malware is controlling infrastructure by modifying Active Directory elements, domain controllers, and policies. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 90 + impact: 90 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index 8a2f71f4d1..065d0dba0c 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -54,3 +54,25 @@ tags: - _time risk_severity: high security_domain: endpoint + message: PowerSploit malware is controlling infrastructure by modifying Active Directory elements or local Master Boot Records. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 90 + impact: 90 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index 78ee3128e5..ab090504f9 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -54,3 +54,27 @@ tags: - _time risk_severity: high security_domain: endpoint + message: PowerSploit malware is planting attack persistence elements, altering privileges and access controls. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 90 + impact: 90 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Command And Control + - Stage:Persistence + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index a2dde3426e..c06ec48cb7 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -50,3 +50,26 @@ tags: - _time risk_severity: high security_domain: endpoint + message: Mimikatz malware is setting highest privileges to malicious entities. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 90 + impact: 90 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index 6da221b86f..0e5006da3c 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -53,3 +53,25 @@ tags: - _time risk_severity: high security_domain: endpoint + message: Mimikatz malware is controlling computer's processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 90 + impact: 90 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index 05a3a77bbd..a50cd7bf44 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -63,3 +63,25 @@ tags: - _time risk_severity: high security_domain: endpoint + message: PowerSploit malware is controlling computer's processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 90 + impact: 90 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index b1beb613c9..96116c46b6 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -48,3 +48,25 @@ tags: - dest_device_id risk_severity: high security_domain: endpoint + message: PowerSploit malware is probing access with stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 60 + impact: 60 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 5a4a6f3e77..af5f430843 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -58,3 +58,25 @@ tags: - dest_user_id risk_severity: low security_domain: endpoint + message: Potential malicious landing to the console via unexpected programs that called cmd.exe. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. + risk_score: 56 + impact: 70 + confidence: 80 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index cb69737544..0d6198b343 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -64,3 +64,24 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: PowerSploit malware is searching for an entry point into the infrastructure, such as local admin accounts, opportunities to hijack processes, unattended install files, or modifiable access objects. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 60 + impact: 60 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index 1368a36a0f..62aa9eeb2b 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -70,3 +70,26 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: PowerSploit malware is searching for and using specific accounts, groups and policies, such as the last logged on account, a local Net group, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 80 + impact: 80 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index 2c8e22fdf5..5b56a94fd9 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -48,3 +48,26 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: Mimikatz malware is searching for and using specific accounts and groups. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 80 + impact: 80 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index ac625bba93..6c027c353f 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -61,3 +61,26 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: PowerSploit malware is seaching for or accessing Active Directory objects such as domain sites, domain trusts, AD forests, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 80 + impact: 80 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index 6adf26a480..f24a07d386 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -53,3 +53,26 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: PowerSploit malware is seaching for or accessing domain controllers, computers, file servers, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 80 + impact: 80 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index aa78cfe32d..711c518530 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -46,3 +46,24 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: Mimikatz malware is collecting information about computers. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 50 + impact: 50 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index 76da48a475..d31378a611 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -60,3 +60,26 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: PowerSploit malware is searching for and tapping into ongoing processes, mounted drives or other operating system elements. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 80 + impact: 80 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index a76f4ed78c..72294fd7b6 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -48,3 +48,26 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: Mimikatz malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 70 + impact: 70 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Lateral Movement + - Stage:Collection + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index f6db3e82b3..007cc8de13 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -52,3 +52,26 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: PowerSploit malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 70 + impact: 70 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Lateral Movement + - Stage:Collection + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index 33fc6d34cb..a9ada10d36 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -54,3 +54,24 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: PowerSploit malware is performing port scans or searching for various connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 70 + impact: 70 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index 4c8421e66a..e0b3608e9d 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -53,3 +53,25 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: Mimikatz malware is searching for and accessing credential stores. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 80 + impact: 80 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index ac476ab344..b4a27caac9 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -47,3 +47,24 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: PowerSploit malware is looking for presence of anti virus software. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 40 + impact: 40 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index f19741ac34..5ee26e0c54 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -48,3 +48,24 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: PowerSploit malware is engaging its privilege escalation module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 60 + impact: 60 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index d612e06810..9bded15a6e 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -53,3 +53,26 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: Mimikatz malware is looking for and invoking Microsoft Detours package that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 70 + impact: 70 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index 2b8315f8a0..168d969872 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -48,3 +48,24 @@ tags: - dest_user_id risk_severity: high security_domain: endpoint + message: Mimikatz malware is listing processes and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 50 + impact: 50 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index 31412eeaac..ee3f6b8bc1 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -59,3 +59,26 @@ tags: - process risk_severity: high security_domain: endpoint + message: DSInternals malware is accessing, using or setting Active Directory or Azure credentials and accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 80 + impact: 80 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Source:Cloud Data + - Stage:Credential Access + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index 11d5848ca3..1cd32183e9 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -50,3 +50,25 @@ tags: - _time risk_severity: high security_domain: endpoint + message: Mimikatz malware is accessing, using or setting account credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 80 + impact: 80 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index e249b05893..8013c39b32 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -50,3 +50,25 @@ tags: - _time risk_severity: high security_domain: endpoint + message: PowerSploit malware is setting passwords on Active Directory accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + risk_score: 90 + impact: 90 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Consequence:Loss Of Control + observable: + - name: dest_user_id + type: User + role: + - Actor + - name: dest_device_id + type: Hostname + role: + - Victim + - name: cmd_line + type: processname + role: + - Others