Branch was auto-updated.

bin/doc_gen.py

@@ -10,6 +10,8 @@ import datetime
 from stix2 import FileSystemSource
 from stix2 import Filter
 
+
+
 def get_all_techniques(projects_path):
     path_cti = path.join(projects_path,'cti/enterprise-attack')
     fs = FileSystemSource(path_cti)
@@ -109,11 +111,6 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
                         sto_to_kill_chain_phases[story] = set(detection['tags']['kill_chain_phases'])
 
                 if 'mitre_attacks' in detection:
-                    if story in sto_to_mitre_attacks.keys():
-                        for mitre_attack in detection['mitre_attacks']:
-                            if mitre_attack not in sto_to_mitre_attacks[story]:
-                                sto_to_mitre_attacks[story].append(mitre_attack)
-                    else:
                         sto_to_mitre_attacks[story] = detection['mitre_attacks']
 
     # add the enrich objects to the story
@@ -198,14 +195,6 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
             f.write(output)
         messages.append("doc_gen.py wrote _page for: {0} structure to: {1}".format(category['name'], output_path))
 
-    # write index updated metrics
-    template = j2_env.get_template('doc_index_markdown.j2')
-    output_path = path.join(OUTPUT_DIR + '/index.markdown')
-    output = template.render(detection_count=len(sorted_detections), story_count=len(sorted_stories))
-    with open(output_path, 'w', encoding="utf-8") as f:
-        f.write(output)
-    messages.append("doc_gen.py wrote site index page to: {0}".format(output_path))
-
     # write stories listing markdown
     template = j2_env.get_template('doc_story_page_markdown.j2')
     output_path = path.join(OUTPUT_DIR + '/_pages/stories.md')
@@ -329,6 +318,71 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag
     messages.append("doc_gen.py wrote {0} detections documentation in mediawiki to: {1}".format(len(detections),output_path))
 
     return sorted_detections, messages
+
+def generate_doc_playbooks(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, messages, VERBOSE):
+    manifest_files = []
+    for root, dirs, files in walk(REPO_PATH + '/playbooks/'):
+        for file in files:
+            if file.endswith(".yml"):
+                manifest_files.append((path.join(root, file)))
+
+    playbooks = []
+    for manifest_file in manifest_files:
+        detection_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                sys.exit(1)
+
+        playbooks.append(object)
+
+    sorted_playbooks = sorted(playbooks, key=lambda i: i['name'])
+
+    j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
+                             trim_blocks=False, autoescape=True)
+
+    # write markdown
+    template = j2_env.get_template('doc_playbooks_markdown.j2')
+    for playbook in sorted_playbooks:
+        file_name = playbook['name'].lower().replace(" ","_") + '.md'
+        output_path = path.join(OUTPUT_DIR + '/_playbooks/' + file_name)
+        output = template.render(playbook=playbook, detections=sorted_detections, time=datetime.datetime.now())
+        with open(output_path, 'w', encoding="utf-8") as f:
+            f.write(output)
+    messages.append("doc_gen.py wrote {0} playbook documentation in markdown to: {1}".format(len(sorted_playbooks),OUTPUT_DIR + '/_playbooks/'))
+
+    # write markdown detection page
+    template = j2_env.get_template('doc_playbooks_page_markdown.j2')
+    output_path = path.join(OUTPUT_DIR + '/_pages/playbooks.md')
+    output = template.render(playbooks=sorted_playbooks, detections=sorted_detections, time=datetime.datetime.now())
+    with open(output_path, 'w', encoding="utf-8") as f:
+        f.write(output)
+    messages.append("doc_gen.py wrote playbooks.md page to: {0}".format(output_path))
+
+    return sorted_playbooks, messages
+
+
+def generate_doc_index(OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, sorted_stories, sorted_playbooks, messages, VERBOSE):
+
+    j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
+                             trim_blocks=False, autoescape=True)
+
+    # write index updated metrics
+    template = j2_env.get_template('doc_index_markdown.j2')
+    output_path = path.join(OUTPUT_DIR + '/index.markdown')
+    output = template.render(detection_count=len(sorted_detections), story_count=len(sorted_stories), playbook_count=len(sorted_playbooks))
+    with open(output_path, 'w', encoding="utf-8") as f:
+        f.write(output)
+    messages.append("doc_gen.py wrote site index page to: {0}".format(output_path))
+
+    return messages
+
 if __name__ == "__main__":
 
     # grab arguments
@@ -355,6 +409,8 @@ if __name__ == "__main__":
     messages = []
     sorted_detections, messages = generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, messages, VERBOSE)
     sorted_stories, messages = generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, sorted_detections, messages, VERBOSE)
+    sorted_playbooks, messages = generate_doc_playbooks(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, messages, VERBOSE)
+    messages = generate_doc_index(OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, sorted_stories, sorted_playbooks, messages, VERBOSE)
 
     # print all the messages from generation
     for m in messages:

bin/jinja2_templates/doc_detection_page_markdown.j2

@@ -8,12 +8,12 @@ sidebar:
   nav: "detections"
 ---
 
-| Name    |   Technique |     Tactic   |        Type   |
-| ----------- | ----------- |--------------| --------------|
+| Name    | Technique | Type       |
+| --------| --------- |------------|
 {%- for detection in detections -%}
 {% if detection.mitre_attacks %}
-| [{{ detection.name }}](/{{ detection.kind }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.mitre_attacks -%} [{{ attack.technique }}](/tags/#{{ attack.technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | [{{ detection.mitre_attacks[0].tactic[0] }}](/tags/#{{ detection.mitre_attacks[0].tactic[0] | lower | replace(" ", "-") }}) | {{ detection.type }} |
+| [{{ detection.name }}](/{{ detection.kind }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.mitre_attacks -%} [{{ attack.technique }}](/tags/#{{ attack.technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | {{ detection.type }} |
 {%- else %}
-| [{{ detection.name }}]() | None | None | {{ detection.type }} |
+| [{{ detection.name }}]() | None | {{ detection.type }} |
 {%- endif -%}
 {%- endfor -%}

bin/jinja2_templates/doc_detections_markdown.j2

@@ -10,6 +10,7 @@ categories:
   - {{detection.kind|capitalize}}
 last_modified_at: {{detection.date}}
 toc: true
+toc_label: ""
 tags:
   - {{ detection.type }}
 {%- for attack in detection.mitre_attacks %}
@@ -51,8 +52,8 @@ We have not been able to test, simulate or build datasets for it, use at your ow
 {% if detection.mitre_attacks %}
 #### ATT&CK
 
-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 {% for attack in detection.mitre_attacks -%}
 {% if attack.technique_id -%}
 {%- set sub_technique = attack.technique_id.split('.') -%}{%- if sub_technique | length > 1 -%}

bin/jinja2_templates/doc_index_markdown.j2

@@ -9,7 +9,7 @@ header:
   actions:
     - label: "Download"
       url: "https://splunkbase.splunk.com/app/3449/"
-excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with over 400+ detections for Splunk."
+excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **{{ detection_count }}** detections for Splunk."
 feature_row:
   - image_path: /static/feature_detection.png
     alt: "customizable"
@@ -28,7 +28,7 @@ feature_row:
   - image_path: /static/feature_playbooks.png
     alt: "100% free"
     title: "Playbooks"
-    excerpt: "See all **2** sets of steps 🐾 to automatically response to a threat."
+    excerpt: "See all **{{ playbook_count }}** sets of steps 🐾 to automatically response to a threat."
     url: "/playbooks"
     btn_class: "btn--primary"
     btn_label: "Explore"
@@ -44,9 +44,9 @@ This project gives you access to our repository of Analytic Stories that are sec
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
 
 ## [Detection Coverage](https://mitremap.splunkresearch.com/) 🗺
-Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-coverage-map.py).
+Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique.
 
-![](mitre-map/coverage.png)
+[![](mitre-map/coverage.png)](https://mitremap.splunkresearch.com/)
 
 ## View Our Content 🔎
 

bin/jinja2_templates/doc_navigation_markdown.j2

@@ -37,3 +37,10 @@ stories:
       - title: {{ category }}
         url: /stories/{{ category | lower | replace(" ", "_") }}/
     {%- endfor %}
+playbooks:
+  - title: "Type"
+    children:
+      - title: "Response"
+        url: /tags/#response/
+      - title: "Investigation"
+        url: /tags/#investigation/

bin/jinja2_templates/doc_playbooks_markdown.j2

@@ -0,0 +1,57 @@
+---
+title: "{{playbook.name}}"
+last_modified_at: {{playbook.date}}
+toc: true
+toc_label: ""
+tags:
+  - {{ playbook.type }}
+{%- for product in playbook.tags.product %}
+  - {{ product }}
+{%- endfor -%}
+{%- for app in playbook.app_list %}
+  - {{ app }}
+{%- endfor %}
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+{{ playbook.description }}
+
+- **Type**: {{ playbook.type }}
+- **Product**: {{ playbook.tags.product|join(', ') }}
+- **Apps**: {% for app in playbook.app_list %}[{{ app }}](https://splunkbase.splunk.com/apps/#/search/{{ app }}/product/soar){% if not loop.last %}, {% endif %}{%-endfor %}
+- **Last Updated**: {{ playbook.date }}
+- **Author**: {{playbook.author}}
+- **ID**: {{ playbook.id }}
+
+#### Associated Detections
+{% for detection in playbook.tags.detections -%}
+{% for d in detections -%}
+{% if d.name == detection -%}
+* [{{ detection }}](/detections/{{ d.type }}/{{detection|lower|replace(" ", "_")}})
+{% endif %}
+{% endfor %}
+{% endfor %}
+
+#### How To Implement
+{{ playbook.how_to_implement}}
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/{{ playbook.name | lower | replace(" ", "_")}}.png)
+
+#### Required field
+{% for field in playbook.tags.playbook_fields -%}
+* {{ field }}
+{% endfor %}
+
+#### Reference
+{% if playbook.references %}
+{% for reference in playbook.references -%}
+* [{{ reference }}]({{ reference }})
+{% endfor %}
+{% endif %}
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/{{ playbook.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{playbook.version}}**

bin/jinja2_templates/doc_playbooks_page_markdown.j2

@@ -0,0 +1,15 @@
+---
+title: "Playbooks"
+layout: collection
+author_profile: false
+permalink: /playbooks/
+classes: wide
+sidebar:
+  nav: "playbooks"
+---
+
+| Name    | Detections | Type        |
+| --------| ---------- | ----------- |
+{% for playbook in playbooks -%}
+| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)|{% for detection in playbook.tags.detections -%}{% for d in detections -%}{% if d.name == detection -%}[{{ detection }}](/detections/{{ d.type }}/{{detection|lower|replace(" ", "_")}}){% endif -%}{%- endfor -%}{%- endfor -%} | {{ playbook.type }} |
+{%- endfor -%}

bin/jinja2_templates/doc_stories_markdown.j2

@@ -2,6 +2,7 @@
 title: "{{story.name}}"
 last_modified_at: {{story.date}}
 toc: true
+toc_label: ""
 tags:
 {%- for product in story.tags.product %}
   - {{ product }}

detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml

@@ -44,6 +44,7 @@ tags:
     of $expected_upper_threshold$ with the following command $command$.
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - DE.DP
   - DE.CM

detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml

@@ -49,6 +49,7 @@ tags:
     command $command$.
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - DE.DP
   - DE.CM

detections/cloud/aws_create_policy_version_to_allow_all_resources.yml

@@ -46,6 +46,7 @@ tags:
     in their account
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_createaccesskey.yml

@@ -43,6 +43,7 @@ tags:
     from this IP $src$
   mitre_attack_id:
   - T1136.003
+  - T1136
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_createloginprofile.yml

@@ -46,6 +46,7 @@ tags:
     and did a console login from this IP $src_ip$
   mitre_attack_id:
   - T1136.003
+  - T1136
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_ecr_container_scanning_findings_high.yml

@@ -37,6 +37,7 @@ tags:
   message: Vulnerabilities with severity high found in image $image$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml

@@ -36,6 +36,7 @@ tags:
   message: Vulnerabilities with severity high found in repository $repositoryName$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_ecr_container_scanning_findings_medium.yml

@@ -35,6 +35,7 @@ tags:
   message: Vulnerabilities with severity high found in image $image$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_ecr_container_upload_outside_business_hours.yml

@@ -33,6 +33,7 @@ tags:
   message: Container uploaded outside business hours from $user$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_ecr_container_upload_unknown_user.yml

@@ -33,6 +33,7 @@ tags:
   message: Container uploaded from unknown user $user$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_iam_successful_group_deletion.yml

@@ -42,6 +42,7 @@ tags:
   mitre_attack_id:
   - T1069.003
   - T1098
+  - T1069
   observable:
   - name: src
     type: IP Address

detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml

@@ -46,6 +46,7 @@ tags:
     CIDR $requestParameters.cidrBlock$
   mitre_attack_id:
   - T1562.007
+  - T1562
   nist:
   - DE.DP
   - DE.AE

detections/cloud/aws_network_access_control_list_deleted.yml

@@ -41,6 +41,7 @@ tags:
     $eventName$), such that the instance is accessible from anywhere
   mitre_attack_id:
   - T1562.007
+  - T1562
   nist:
   - DE.DP
   - DE.AE

detections/cloud/aws_setdefaultpolicyversion.yml

@@ -45,6 +45,7 @@ tags:
     event $eventName$ for updating the the default policy version
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - PR.DS
   - PR.AC

detections/cloud/aws_updateloginprofile.yml

@@ -39,6 +39,7 @@ tags:
     user $user_arn$ more access privilleges
   mitre_attack_id:
   - T1136.003
+  - T1136
   nist:
   - PR.DS
   - PR.AC

detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml

@@ -44,6 +44,7 @@ tags:
   message: User $user$ is creating a new instance $dest$ for the first time
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - ID.AM
   observable:

detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml

@@ -44,6 +44,7 @@ tags:
   message: User $user$ is modifying an instance $dest$ for the first time.
   mitre_attack_id:
   - T1078.004
+  - T1078
   nist:
   - ID.AM
   observable:

detections/cloud/correlation_by_repository_and_risk.yml

@@ -27,6 +27,7 @@ tags:
   message: Correlation triggered for user $user$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/correlation_by_user_and_risk.yml

@@ -27,6 +27,7 @@ tags:
   message: Correlation triggered for user $user$
   mitre_attack_id:
   - T1204.003
+  - T1204
   nist:
   - PR.DS
   - PR.AC

detections/cloud/github_commit_changes_in_master.yml

@@ -23,7 +23,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
   analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
   automated_detection_testing: passed
   confidence: 30
   context:

detections/cloud/github_commit_in_develop.yml

@@ -22,7 +22,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
   analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
   automated_detection_testing: passed
   confidence: 30
   context:

detections/cloud/github_dependabot_alert.yml

@@ -33,6 +33,7 @@ tags:
   message: Vulnerabilities found in packages used by GitHub repository $repository$
   mitre_attack_id:
   - T1195.001
+  - T1195
   nist:
   - PR.DS
   - PR.AC

detections/cloud/github_pull_request_from_unknown_user.yml

@@ -33,6 +33,7 @@ tags:
   message: Vulnerabilities found in packages used by GitHub repository $repository$
   mitre_attack_id:
   - T1195.001
+  - T1195
   nist:
   - PR.DS
   - PR.AC

detections/cloud/gsuite_drive_share_in_external_email.yml

@@ -19,14 +19,14 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner
   | `gsuite_drive_share_in_external_email_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs related to gsuite having the file attachment metadata like file type, file
-  extension, source email, destination email, num of attachment and etc.
+  extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
 known_false_positives: network admin or normal user may share files to customer and
   external team.
 references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
   analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
   confidence: 90
   context:
   - Source:Endpoint
@@ -41,11 +41,12 @@ tags:
   message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
   mitre_attack_id:
   - T1567.002
+  - T1567
   observable:
   - name: parameters.owner
     type: User
     role:
-    - attacker
+    - Attacker
   - name: email
     type: User
     role:
@@ -66,3 +67,4 @@ tags:
   - parameters.doc_type
   risk_score: 72
   security_domain: endpoint
+

detections/cloud/gsuite_email_suspicious_attachment.yml

@@ -28,7 +28,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
   analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
   confidence: 70
   context:
   - Source:Endpoint
@@ -41,6 +41,7 @@ tags:
   message: suspicious email from $source.address$ to $destination{}.address$
   mitre_attack_id:
   - T1566.001
+  - T1566
   observable:
   - name: source.address
     type: User

detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml

@@ -35,7 +35,7 @@ references:
 - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
 tags:
   analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -49,6 +49,7 @@ tags:
   message: suspicious email from $source.address$ to $destination{}.address$
   mitre_attack_id:
   - T1566.001
+  - T1566
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml

@@ -26,7 +26,7 @@ references:
 - https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/
 tags:
   analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -40,6 +40,7 @@ tags:
   message: suspicious email from $source.address$ to $destination{}.address$
   mitre_attack_id:
   - T1566.001
+  - T1566
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml

@@ -27,7 +27,7 @@ references:
 - https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
   analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
   confidence: 30
   context:
   - Source:Endpoint
@@ -40,6 +40,7 @@ tags:
   message: suspicious email from $source.address$ to $destination{}.address$
   mitre_attack_id:
   - T1048.003
+  - T1048
   observable:
   - name: source.address
     type: User

detections/cloud/gsuite_suspicious_shared_file_name.yml

@@ -24,7 +24,7 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit
   | `gsuite_suspicious_shared_file_name_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs related to gsuite having the file attachment metadata like file type, file
-  extension, source email, destination email, num of attachment and etc.
+  extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
 known_false_positives: normal user or normal transaction may contain the subject and
   file type attachment that this detection try to search
 references:
@@ -32,7 +32,7 @@ references:
 - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
 tags:
   analytic_story:
-  - DevSecOps
+  - Dev Sec Ops
   automated_detection_testing: passed
   confidence: 70
   context:
@@ -46,6 +46,7 @@ tags:
   message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
   mitre_attack_id:
   - T1566.001
+  - T1566
   observable:
   - name: parameters.owner
     type: User

detections/cloud/o365_add_app_role_assignment_grant_user.yml

@@ -41,6 +41,7 @@ tags:
     Address $ActorIpAddress$
   mitre_attack_id:
   - T1136.003
+  - T1136
   observable:
   - name: ActorIpAddress
     type: IP Address

detections/cloud/o365_added_service_principal.yml

@@ -44,6 +44,7 @@ tags:
     service principal credentials from IP Address $ActorIpAddress$
   mitre_attack_id:
   - T1136.003
+  - T1136
   observable:
   - name: ActorIpAddress
     type: IP Address

detections/cloud/o365_bypass_mfa_via_trusted_ip.yml

@@ -45,6 +45,7 @@ tags:
     list of trusted IPs to bypass MFA
   mitre_attack_id:
   - T1562.007
+  - T1562
   observable:
   - name: ip_addresses_new_added
     type: IP Address

detections/cloud/o365_new_federated_domain_added.yml

@@ -44,6 +44,7 @@ tags:
     $OrganizationName$
   mitre_attack_id:
   - T1136.003
+  - T1136
   observable:
   - name: OrganizationName
     type: Other

detections/cloud/o365_suspicious_admin_email_forwarding.yml

@@ -39,6 +39,7 @@ tags:
     the same destination $ForwardingAddress$
   mitre_attack_id:
   - T1114.003
+  - T1114
   nist:
   - DE.DP
   - DE.AE

detections/cloud/o365_suspicious_rights_delegation.yml

@@ -38,6 +38,7 @@ tags:
     that allow access to sensitive
   mitre_attack_id:
   - T1114.002
+  - T1114
   nist:
   - DE.DP
   - DE.AE

detections/cloud/o365_suspicious_user_email_forwarding.yml

@@ -39,6 +39,7 @@ tags:
     a forwarding rule to same destination $ForwardingSmtpAddress$
   mitre_attack_id:
   - T1114.003
+  - T1114
   nist:
   - DE.DP
   - DE.AE

detections/endpoint/active_setup_registry_autostart.yml

@@ -0,0 +1,70 @@
+name: Active Setup Registry Autostart
+id: f64579c0-203f-11ec-abcc-acde48001122
+version: 1
+date: '2021-09-28'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious modification of the active setup
+  registry for persistence and privilege escalation. This technique was seen in several
+  malware (poisonIvy), adware and APT to gain persistence to the compromised machine
+  upon boot up. This TTP is a good indicator to further check the process id that
+  do the modification since modification of this registry is not commonly done. check
+  the legitimacy of the file and process involve in this rules to check if it is a
+  valid setup installer that creating or modifying this registry.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name
+  = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed
+  Components*" by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
+  | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting
+  data that records registry activity from your hosts to populate the endpoint data
+  model in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: Active setup installer may add or modify this registry.
+references:
+- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E
+- https://attack.mitre.org/techniques/T1547/014/
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1547.014
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  security_domain: endpoint
+  impact: 80
+  confidence: 80
+  risk_score: 64
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/change_default_file_association.yml

@@ -0,0 +1,67 @@
+name: Change Default File Association
+id: 462d17d8-1f71-11ec-ad07-acde48001122
+version: 1
+date: '2021-09-27'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is developed to detect suspicious registry modification
+  to change the default file association of windows to malicious payload. This techninique
+  was seen in some APT where it modify the default process to run file association,
+  like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other
+  payload that will load malicious command to the compromised host.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
+  ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest  Registry.user
+  Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
+  `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
+  | `change_default_file_association_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1546.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/disable_security_logs_using_minint_registry.yml

@@ -0,0 +1,65 @@
+name: Disable Security Logs Using MiniNt Registry
+id: 39ebdc68-25b9-11ec-aec7-acde48001122
+version: 1
+date: '2021-10-05'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious registry modification to disable
+  security audit logs. This technique was shared by a researcher to disable Security
+  logs of windows by adding this registry. The Windows will think it is WinPE and
+  will not log any event to the Security Log
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*"
+  by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name
+  Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `disable_security_logs_using_minint_registry_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting
+  data that records registry activity from your hosts to populate the endpoint data
+  model in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: Unknown.
+references:
+- https://twitter.com/0gtweet/status/1182516740955226112
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/disable_uac_remote_restriction.yml

@@ -0,0 +1,69 @@
+name: Disable UAC Remote Restriction
+id: 9928b732-210e-11ec-b65e-acde48001122
+version: 1
+date: '2021-09-29'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious modification of registry to disable
+  UAC remote restriction. This technique was well documented in Microsoft page where
+  attacker may modify this registry value to bypassed UAC feature of windows host.
+  This is a good indicator that some tries to bypassed UAC to suspicious process or
+  gain privilege escalation.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
+  ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy"
+  Registry.registry_value_data="0x00000001" by Registry.dest  Registry.user Registry.registry_path
+  Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
+  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
+  | `disable_uac_remote_restriction_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: admin may set this policy for non-critical machine.
+references:
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Suspicious Windows Registry Activities
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1548.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/enable_wdigest_uselogoncredential_registry.yml

@@ -0,0 +1,68 @@
+name: Enable WDigest UseLogonCredential Registry
+id: 0c7d8ffe-25b1-11ec-9f39-acde48001122
+version: 1
+date: '2021-10-05'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious registry modification to enable
+  plain text credential feature of windows. This technique was used by several malware
+  and also by mimikatz to be able to dumpe the a plain text credential to the compromised
+  or target host. This TTP is really a good indicator that someone wants to dump the
+  crendential of the host so it must be a good pivot for credential dumping techniques.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*"
+  Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data
+  = 0x00000001 by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name
+  Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `enable_wdigest_uselogoncredential_registry_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting
+  data that records registry activity from your hosts to populate the endpoint data
+  model in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html
+tags:
+  analytic_story:
+  - Credential Dumping
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  - T1003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  message: wdigest registry $registry_path$ was modified in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/etw_registry_disabled.yml

@@ -0,0 +1,67 @@
+name: ETW Registry Disabled
+id: 8ed523ac-276b-11ec-ac39-acde48001122
+version: 1
+date: '2021-10-07'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a registry modification to disable ETW feature
+  of windows. This technique is to evade EDR appliance to evade detections and hide
+  its execution from audit logs.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*")
+  Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `etw_registry_disabled_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting
+  data that records registry activity from your hosts to populate the endpoint data
+  model in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.006
+  - T1127
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.registry_value_data
+  security_domain: endpoint
+  impact: 90
+  confidence: 100
+  risk_score: 90
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/logon_script_event_trigger_execution.yml

@@ -0,0 +1,65 @@
+name: Logon Script Event Trigger Execution
+id: 4c38c264-1f74-11ec-b5fa-acde48001122
+version: 1
+date: '2021-09-27'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a suspicious modification of registry entry
+  to persist and gain privilege escalation upon booting up of compromised host. This
+  technique was seen in several APT and malware where it modify UserInitMprLogonScript
+  registry entry to its malicious payload to be executed upon boot up of the machine.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
+  IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest  Registry.user Registry.registry_path
+  Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://attack.mitre.org/techniques/T1037/001
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1037.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/malicious_inprocserver32_modification.yml

@@ -0,0 +1,86 @@
+name: Malicious InProcServer32 Modification
+id: 127c8d08-25ff-11ec-9223-acde48001122
+version: 1
+date: '2021-10-05'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a process modifying the registry with
+  a known malicious CLSID under InProcServer32. Most COM classes are registered with
+  the operating system and are identified by a GUID that represents the Class Identifier
+  (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID).  Behind
+  the implementation of a COM class is the server (some binary) that is referenced
+  within registry keys under the CLSID.  The LocalServer32 key represents a path to
+  an executable (exe) implementation, and the InprocServer32 key represents a path
+  to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel
+  processes for suspicious activity. Pivot on the process GUID to see the full timeline
+  of events. Analyze the value and look for file modifications. Being this is looking
+  for inprocserver32, a DLL found in the value will most likely be loaded by a parallel
+  process.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
+  Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
+  `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path=
+  "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by
+  Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest
+  Registry.process_guid Registry.user | `drop_dm_object_name(Registry)` | fields _time
+  dest registry_path registry_key_name registry_value_name process_name process_path
+  process process_guid user] | stats count min(_time) as firstTime max(_time) as lastTime
+  by dest, process_name registry_path registry_key_name registry_value_name user |
+  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited, filter as needed. In our
+  test case, Remcos used regsvr32.exe to modify the registry. It may be required,
+  dependent upon the EDR tool producing registry events, to remove (Default) from
+  the command-line.
+references:
+- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
+- https://tria.ge/210929-ap75vsddan
+- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
+tags:
+  analytic_story:
+  - Suspicious Regsvr32 Activity
+  - Remcos
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.010
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - process_name
+  - registry_path
+  - registry_key_name
+  - registry_value_name
+  - user
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The $process_name$ was identified on endpoint $dest$ modifying the registry
+    with a known malicious clsid under InProcServer32.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml

@@ -0,0 +1,65 @@
+name: MSBuild Suspicious Spawned By Script Process
+id: 213b3148-24ea-11ec-93a2-acde48001122
+version: 1
+date: '2021-10-04'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious child process of MSBuild 
+  spawned by Windows Script Host - cscript or wscript. 
+  This behavior or event are commonly seen and used by malware or adversaries
+  to execute malicious msbuild process using malicious script in the compromised host.
+  During triage, review parallel processes and identify any file modifications. MSBuild
+  may load a script from the same path without having command-line arguments.
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("wscript.exe", "cscript.exe") AND `process_msbuild` by Processes.dest Processes.parent_process
+  Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives should be limited as developers do not spawn MSBuild via a WSH.
+references:
+- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#
+tags:
+  analytic_story:
+  - Trusted Developer Utilities Proxy Execution MSBuild
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1127.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.parent_process
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.original_file_name
+  - Processes.user
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Stage:Execution
+  - Stage:Defense Evasion
+  message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed
+    by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/process_writing_dynamicwrapperx.yml

@@ -0,0 +1,86 @@
+name: Process Writing DynamicWrapperX
+id: b0a078e4-2601-11ec-9aec-acde48001122
+version: 1
+date: '2021-10-05'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: DynamicWrapperX is an ActiveX component that can be used in a script
+  to call Windows API functions, but it requires the dynwrapx.dll to be installed
+  and registered. With that, a binary writing dynwrapx.dll to disk and registering
+  it into the registry is highly suspect. Why is it needed? In most malicious instances,
+  it will be written to disk at a non-standard location. During triage, review parallel
+  processes and pivot on the process_guid. Review the registry for any suspicious
+  modifications meant to load dynwrapx.dll. Identify any suspicious module loads of
+  dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
+  Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
+  `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where
+  Filesystem.file_name="dynwrapx.dll" by _time Filesystem.dest Filesystem.file_create_time
+  Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user
+  | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name
+  file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time)
+  as lastTime by dest process_name process_guid file_name file_path file_create_time
+  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `process_writing_dynamicwrapperx_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
+  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
+  latest TA for the endpoint product.
+known_false_positives: False positives should be limited, however it is possible to
+  filter by Processes.process_name and specific processes (ex. wscript.exe). Filter
+  as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default).
+references:
+- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
+- https://www.script-coding.com/dynwrapx_eng.html
+- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
+- https://tria.ge/210929-ap75vsddan
+- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
+tags:
+  analytic_story:
+  - Remcos
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059
+  - T1559.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - process_name
+  - process_guid
+  - file_name
+  - file_path
+  - file_create_time user
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $process_name$ was identified on endpoint $dest$ downloading
+    the DynamicWrapperX dll.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -11,7 +11,8 @@ description: The search looks for modifications to registry keys that can be use
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
   as registry_key_name values(Registry.registry_path) as registry_path min(_time)
   as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run*
-  OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell*
+  OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* 
+  OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify*
   OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet*
   OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices*
   OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows

detections/endpoint/regsvr32_silent_param_dll_loading.yml

@@ -0,0 +1,73 @@
+name: Regsvr32 Silent Param Dll Loading
+id: f421c250-24e7-11ec-bc43-acde48001122
+version: 1
+date: '2021-10-04'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a loading of dll using regsvr32 application
+  with silent parameter and dllinstall execution. This technique was seen in several
+  RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised
+  machine. This TTP may executed by normal 3rd party application so it is better to
+  pivot the parent process, parent commandline and commandline of the file that execute
+  this regsvr32.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe
+  Processes.process="*/i*" Processes.process="*/s*" by Processes.dest Processes.parent_process
+  Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `regsvr32_silent_param_dll_loading_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Other third part application may used this parameter but not
+  so common in base windows environment.
+references:
+- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#
+- https://attack.mitre.org/techniques/T1218/010/
+tags:
+  analytic_story:
+  - Suspicious Regsvr32 Activity
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.010
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 60
+  confidence: 60
+  risk_score: 36
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: regsvr32 process with $process$ commandline in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/rundll32_shimcache_flush.yml

@@ -0,0 +1,67 @@
+name: Rundll32 Shimcache Flush
+id: a913718a-25b6-11ec-96d3-acde48001122
+version: 1
+date: '2021-10-05'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious rundll32 commandline to clear
+  shim cache. This technique is a anti-forensic technique to clear the cache taht
+  are one important artifacts in terms of digital forensic during attacks or incident.
+  This TTP is a good indicator that someone tries to evade some tools and clear foothold
+  on the machine.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where  `process_rundll32` AND Processes.process
+  = "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `rundll32_shimcache_flush_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: unknown
+references:
+- https://blueteamops.medium.com/shimcache-flush-89daff28d15e
+tags:
+  analytic_story:
+  - Unusual Processes
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Stage:Execution
+  - Stage:Defense Evasion
+  message: rundll32 process execute $process$ to clear shim cache in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/screensaver_event_trigger_execution.yml

@@ -0,0 +1,68 @@
+name: Screensaver Event Trigger Execution
+id: 58cea3ec-1f6d-11ec-8560-acde48001122
+version: 1
+date: '2021-09-27'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is developed to detect possible event trigger execution
+  through screensaver registry entry modification for persistence or privilege escalation.
+  This technique was seen in several APT and malware where they put the malicious
+  payload path to the SCRNSAVE.EXE registry key to redirect the execution to their
+  malicious payload path. This TTP is a good indicator that some attacker may modify
+  this entry for their persistence and privilege escalation.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control
+  Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.dest Registry.user Registry.registry_path
+  Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `screensaver_event_trigger_execution_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://attack.mitre.org/techniques/T1546/002/
+- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1546.002
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  security_domain: endpoint
+  impact: 80
+  confidence: 90
+  risk_score: 72
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/sdelete_application_execution.yml

@@ -0,0 +1,70 @@
+name: Sdelete Application Execution
+id: 31702fc0-2682-11ec-85c3-acde48001122
+version: 1
+date: '2021-10-06'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect the execution of sdelete.exe application sysinternal
+  tools. This tool is one of the most use tool of malware and adversaries to remove
+  or clear their tracks and artifact in the targetted host. This tool is designed
+  to delete securely a file in file system that remove the forensic evidence on the
+  machine. A good TTP query to check why user execute this application which is not
+  a common practice.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.parent_process) as parent_process values(Processes.process_id)
+  as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where `process_sdelete` by  Processes.process_name Processes.original_file_name
+  Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `sdelete_application_execution_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: user may execute and use this application
+references:
+- https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/
+tags:
+  analytic_story:
+  - Masquerading - Rename System Utilities
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1485
+  - T1070.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: sdelete process $process_name$ executed in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/suspicious_copy_on_system32.yml

@@ -0,0 +1,68 @@
+name: Suspicious Copy on System32
+id: ce633e56-25b2-11ec-9e76-acde48001122
+version: 1
+date: '2021-10-05'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious copy of file from systemroot
+  folder of the windows OS. This technique is commonly used by APT or other malware
+  as part of execution (LOLBIN) to run its malicious code using the available legitimate
+  tool in OS. this type of event may seen or may execute of normal user in some instance
+  but this is really a anomaly that needs to be check within the network.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*",
+  "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `suspicious_copy_on_system32_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: every user may do this event but very un-ussual.
+references:
+- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
+tags:
+  analytic_story:
+  - Unusual Processes
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1036.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 90
+  risk_score: 63
+  context:
+  - Stage:Execution
+  - Stage:Defense Evasion
+  message: execution of copy exe to copy file from $process$ in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/suspicious_wevtutil_usage.yml

@@ -1,18 +1,18 @@
 name: Suspicious wevtutil Usage
 id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f
-version: 3
-date: '2020-07-22'
-author: David Dorsey, Splunk
+version: 4
+date: '2021-10-11'
+author: David Dorsey, Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: The wevtutil.exe application is the windows event log utility. This searches
-  for wevtutil.exe with parameters for clearing the application, security, setup,
+  for wevtutil.exe with parameters for clearing the application, security, setup, trace
   or system event logs.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name = wevtutil.exe Processes.process="*cl*" (Processes.process="*System*"
-  OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*")
+  where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") (Processes.process="*System*"
+  OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*" OR Processes.process="*trace*")
   by Processes.process_name Processes.parent_process_name Processes.dest Processes.user|
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `suspicious_wevtutil_usage_filter`'
@@ -23,13 +23,13 @@ how_to_implement: You must be ingesting data that records process activity from
   model.
 known_false_positives: The wevtutil.exe application is a legitimate Windows event
   log utility. Administrators may use it to manage Windows event logs.
-references: []
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
 tags:
   analytic_story:
   - Windows Log Manipulation
   - Ransomware
   - Clop Ransomware
-  asset_type: ''
   automated_detection_testing: passed
   cis20:
   - CIS 3

detections/endpoint/time_provider_persistence_registry.yml

@@ -0,0 +1,68 @@
+name: Time Provider Persistence Registry
+id: 5ba382c4-2105-11ec-8d8f-acde48001122
+version: 1
+date: '2021-09-29'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspiciouos modification of time provider
+  registry for persistence and autostart. This technique can allow the attacker to
+  persist on the compromised host and autostart as soon as the machine boot up. This
+  TTP can be a good indicator of suspicious behavior since this registry is not commonly
+  modified by normal user or even an admin.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
+  ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by Registry.dest  Registry.user
+  Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
+  `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
+  | `time_provider_persistence_registry_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: unknown
+references:
+- https://pentestlab.blog/2019/10/22/persistence-time-providers/
+- https://attack.mitre.org/techniques/T1547/003/
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1547.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/vbscript_execution_using_wscript_app.yml

@@ -0,0 +1,69 @@
+name: Vbscript Execution Using Wscript App
+id: 35159940-228f-11ec-8a49-acde48001122
+version: 1
+date: '2021-10-01'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious wscript commandline to execute
+  vbscript. This technique was seen in several malware to execute malicious vbs file
+  using wscript application. commonly vbs script is associated to cscript process
+  and this can be a technique to evade process parent child detections or even some
+  av script emulation system.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
+  = "wscript.exe" AND Processes.parent_process = "*//e:vbscript*") OR (Processes.process_name
+  = "wscript.exe" AND Processes.process = "*//e:vbscript*") by Processes.parent_process_name
+  Processes.parent_process Processes.process_name Processes.process_id Processes.process
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: unknown
+references:
+- https://www.joesandbox.com/analysis/369332/0/html
+tags:
+  analytic_story:
+  - FIN7
+  - Remcos
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1059.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: Process name $process_name$ with commandline $process$ to execute vbsscript
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/verclsid_clsid_execution.yml

@@ -0,0 +1,72 @@
+name: Verclsid CLSID Execution
+id: 61e9a56a-20fa-11ec-8ba3-acde48001122
+version: 1
+date: '2021-09-29'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic is to detect a possible abuse of verclsid to execute malicious
+  file through generate CLSID. This process is a normal application of windows to
+  verify the CLSID COM object before it is instantiated by Windows Explorer. This
+  hunting query can be a good pivot point to analyze what is he CLSID or COM object
+  pointing too to check if it is a valid application or not.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  values(Processes.parent_process) as parent_process values(Processes.process_id)
+  as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where `process_verclsid` AND Processes.process="*/S*" Processes.process="*/C*" AND  Processes.process="*{*"
+  AND Processes.process="*}*" by  Processes.process_name Processes.original_file_name
+  Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `verclsid_clsid_execution_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: windows can used this application for its normal COM object
+  validation.
+references:
+- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
+- https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
+tags:
+  analytic_story:
+  - Unusual Processes
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.012
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - source:endpoint
+  - stage:Defense Evasion
+  message: process $process_name$ to execute possible clsid commandline $process$
+    in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/winhlp32_spawning_a_process.yml

@@ -0,0 +1,88 @@
+name: Winhlp32 Spawning a Process
+id: d17dae9e-2618-11ec-b9f5-acde48001122
+version: 1
+date: '2021-10-05'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies winhlp32.exe, found natively in `c:\windows\`,
+  spawning a child process that loads a file out of appdata, programdata, or temp.
+  Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added
+  to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the
+  ".hlp" file name extension. This particular instance is related to a Remcos sample
+  where dynwrapx.dll is added to the registry under inprocserver32, and later module
+  loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During
+  triage, review parallel processes to identify further suspicious behavior. Review
+  module loads for unsuspecting unsigned modules. Capture any file modifications and
+  analyze.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winhlp32.exe
+  Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winhlp32_spawning_a_process_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited as winhlp32.exe is typically
+  not used with the latest flavors of Windows OS. However, filter as needed.
+references:
+- https://www.exploit-db.com/exploits/16541
+- https://tria.ge/210929-ap75vsddan
+- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
+tags:
+  analytic_story:
+  - Remcos
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$, and is not typical activity for this process.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/wscript_or_cscript_suspicious_child_process.yml

@@ -0,0 +1,78 @@
+name: Wscript Or Cscript Suspicious Child Process
+id: 1f35e1da-267b-11ec-90a9-acde48001122
+version: 1
+date: '2021-10-06'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious spawned process by wscript or
+  cscript process. This technique was a common technique used by adversaries and malware
+  to execute different LOLBIN, other script like powershell or create a suspended
+  process to inject its code as a defense evasion. This TTP may detect some normal
+  script that using several application tool that are in the list of the child process
+  it detects but a good pivot and indicator that a script is may execute suspicious
+  code.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("cscript.exe", "wscript.exe") Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `wscript_or_cscript_suspicious_child_process_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: user may create vbs or js script that use several tool as part
+  of its execution.
+references:
+- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
+tags:
+  analytic_story:
+  - FIN7
+  - Remcos
+  - Unusual Processes
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1055
+  - T1543
+  - T1134.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  message: wscript or cscript parent process spawned $process_name$ in $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: user
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/experimental/endpoint/print_processor_registry_autostart.yml

@@ -0,0 +1,69 @@
+name: Print Processor Registry Autostart
+id: 1f5b68aa-2037-11ec-898e-acde48001122
+version: 1
+date: '2021-09-28'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to detect a suspicious modification or new registry entry regarding print processor. 
+  This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine. 
+  This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services.
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path ="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" 
+  by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name 
+  | `security_content_ctime(lastTime)`  
+  | `security_content_ctime(firstTime)`
+  | `drop_dm_object_name(Registry)`
+  | `print_processor_registry_autostart_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: possible new printer installation may add driver component on this registry.
+references:
+- https://attack.mitre.org/techniques/T1547/012/
+- https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  - Windows Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1547.012
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.dest 
+  - Registry.user 
+  - Registry.registry_path 
+  - Registry.registry_key_name 
+  - Registry.registry_value_name 
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - source:endpoint
+  - stage:Privilege Escalation Persistence
+  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
+  

detections/network/dns_query_length_with_high_standard_deviation.yml

@@ -1,7 +1,7 @@
 name: DNS Query Length With High Standard Deviation
 id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5
-version: 3
-date: '2021-07-21'
+version: 4
+date: '2021-10-06'
 author: Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
@@ -11,10 +11,11 @@ description: This search allows you to identify DNS requests and compute the sta
   standard deviation to show you those queries that are unusually large for your environment.
 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
   where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")`
+  | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) | search tld_len<=24
   | eval query_length = len(query) | table query query_length record_type count |
   eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length)
   AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev
-  | `dns_query_length_with_high_standard_deviation_filter` '
+  | `dns_query_length_with_high_standard_deviation_filter`'
 how_to_implement: To successfully implement this search, you will need to ensure that
   DNS data is populating the Network_Resolution data model.
 known_false_positives: It's possible there can be long domain names that are legitimate.

docs/CNAME

@@ -1 +1 @@
-splunkresearch.com
+research.splunk.com

docs/Gemfile.lock

@@ -25,11 +25,11 @@ GEM
     em-websocket (0.5.2)
       eventmachine (>= 0.12.9)
       http_parser.rb (~> 0.6.0)
-    ethon (0.14.0)
+    ethon (0.15.0)
       ffi (>= 1.15.0)
     eventmachine (1.2.7)
     execjs (2.8.1)
-    faraday (1.7.1)
+    faraday (1.8.0)
       faraday-em_http (~> 1.0)
       faraday-em_synchrony (~> 1.0)
       faraday-excon (~> 1.1)
@@ -52,8 +52,8 @@ GEM
     filesize (0.2.0)
     forwardable-extended (2.6.0)
     gemoji (3.0.1)
-    github-pages (219)
-      github-pages-health-check (= 1.17.7)
+    github-pages (220)
+      github-pages-health-check (= 1.17.9)
       jekyll (= 3.9.0)
       jekyll-avatar (= 0.7.0)
       jekyll-coffeescript (= 1.1.1)
@@ -96,7 +96,7 @@ GEM
       nokogiri (>= 1.10.4, < 2.0)
       rouge (= 3.26.0)
       terminal-table (~> 1.4)
-    github-pages-health-check (1.17.7)
+    github-pages-health-check (1.17.9)
       addressable (~> 2.3)
       dnsruby (~> 1.60)
       octokit (~> 4.0)
@@ -242,6 +242,8 @@ GEM
       jekyll-seo-tag (~> 2.1)
     multi_json (1.15.0)
     multipart-post (2.1.1)
+    nokogiri (1.12.5-x86_64-darwin)
+      racc (~> 1.4)
     nokogiri (1.12.5-x86_64-linux)
       racc (~> 1.4)
     octokit (4.21.0)
@@ -278,16 +280,17 @@ GEM
       ethon (>= 0.9.0)
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2021.1)
+    tzinfo-data (1.2021.3)
       tzinfo (>= 1.0.0)
     unf (0.1.4)
       unf_ext
-    unf_ext (0.0.7.7)
-    unicode-display_width (1.7.0)
+    unf_ext (0.0.8)
+    unicode-display_width (1.8.0)
     verbal_expressions (0.1.5)
     webrick (1.7.0)
 
 PLATFORMS
+  x86_64-darwin-20
   x86_64-linux
 
 DEPENDENCIES
@@ -303,4 +306,4 @@ DEPENDENCIES
   webrick (~> 1.7)
 
 BUNDLED WITH
-   2.2.27
+   2.2.29

docs/_config.yml

@@ -6,7 +6,7 @@ description: >- # this means to ignore newlines until "baseurl:"
   mapped to the MITRE ATT&CK Framework, the Lockheed Martin Cyber Kill Chain, and CIS Controls.
   They include Splunk searches, machine learning algorithms and
   Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
-name: Jose Hernandez
+name: Splunk Threat Research Team (STRT)
 url: "https://splunkresearch.com"
 baseurl: "/" # the subpath of your site, e.g. /blog
 url: "https://splunkresearch.com" # the base hostname & protocol for your site, e.g. http://example.com
@@ -88,6 +88,9 @@ collections:
   stories:
     output: true
     permalink: /:collection/:path/
+  playbooks:
+    output: true
+    permalink: /:collection/:path/
 
 defaults:
   # _docs
@@ -121,7 +124,17 @@ defaults:
       share: true
       related: true
       toc: true
-
+  # _playbooks
+  - scope:
+      path: "_playbooks"
+      type: playbooks
+    values:
+      layout: single
+      author_profile: false
+      comments: true
+      share: true
+      related: true
+      toc: true
 category_archive:
   type: liquid
   path: /categories/
@@ -135,4 +148,3 @@ analytics:
   google:
     tracking_id: "G-83V3JSYPS7"
     anonymize_ip: false # default
-

docs/_data/navigation.yml

@@ -84,4 +84,11 @@ stories:
       - title: Malware
         url: /stories/malware/
       - title: Vulnerability
-        url: /stories/vulnerability/
+        url: /stories/vulnerability/
+playbooks:
+  - title: "Type"
+    children:
+      - title: "Response"
+        url: /tags/#response/
+      - title: "Investigation"
+        url: /tags/#investigation/

docs/_pages/adversary_tactics.md

@@ -10,52 +10,52 @@ sidebar:
 
 | Name        | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| [Active Directory Discovery](/stories/active_directory_discovery/) | [Domain Account](/tags/#domain-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Domain Groups](/tags/#domain-groups), [Password Policy Discovery](/tags/#password-policy-discovery), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Discovery](/tags/#discovery) |
+| [Active Directory Discovery](/stories/active_directory_discovery/) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Active Directory Password Spraying](/stories/active_directory_password_spraying/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) |
-| [BITS Jobs](/stories/bits_jobs/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Defense Evasion](/tags/#defense-evasion) |
+| [BITS Jobs](/stories/bits_jobs/) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Cobalt Strike](/stories/cobalt_strike/) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) |
-| [Collection and Staging](/stories/collection_and_staging/) | [Archive via Utility](/tags/#archive-via-utility), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection), [Masquerading](/tags/#masquerading) | [Collection](/tags/#collection) |
-| [Command and Control](/stories/command_and_control/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
-| [Credential Dumping](/stories/credential_dumping/) | [LSASS Memory](/tags/#lsass-memory), [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Kerberoasting](/tags/#kerberoasting), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access) |
+| [Cobalt Strike](/stories/cobalt_strike/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
+| [Collection and Staging](/stories/collection_and_staging/) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
+| [Command and Control](/stories/command_and_control/) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) |
+| [Credential Dumping](/stories/credential_dumping/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) |
 | [DNS Hijacking](/stories/dns_hijacking/) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) |
-| [Data Exfiltration](/stories/data_exfiltration/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
+| [Data Exfiltration](/stories/data_exfiltration/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) |
 | [Deobfuscate-Decode Files or Information](/stories/deobfuscate-decode_files_or_information/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) |
-| [Detect Zerologon Attack](/stories/detect_zerologon_attack/) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services), [LSASS Memory](/tags/#lsass-memory), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Lateral Movement](/tags/#lateral-movement) |
-| [Disabling Security Tools](/stories/disabling_security_tools/) | [Install Root Certificate](/tags/#install-root-certificate), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows Service](/tags/#windows-service), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
-| [Domain Trust Discovery](/stories/domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
+| [Detect Zerologon Attack](/stories/detect_zerologon_attack/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
+| [Disabling Security Tools](/stories/disabling_security_tools/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) |
+| [Domain Trust Discovery](/stories/domain_trust_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
 | [F5 TMUI RCE CVE-2020-5902](/stories/f5_tmui_rce_cve-2020-5902/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [HAFNIUM Group](/stories/hafnium_group/) | [PowerShell](/tags/#powershell), [Web Shell](/tags/#web-shell), [Local Account](/tags/#local-account), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [LSASS Memory](/tags/#lsass-memory), [Remote Email Collection](/tags/#remote-email-collection), [NTDS](/tags/#ntds), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Execution](/tags/#execution) |
-| [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) |
-| [Lateral Movement](/stories/lateral_movement/) | [Pass the Hash](/tags/#pass-the-hash), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [Kerberoasting](/tags/#kerberoasting), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Scheduled Task](/tags/#scheduled-task) | [Defense Evasion](/tags/#defense-evasion) |
-| [Malicious PowerShell](/stories/malicious_powershell/) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) |
-| [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
+| [HAFNIUM Group](/stories/hafnium_group/) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
+| [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) |
+| [Lateral Movement](/stories/lateral_movement/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Malicious PowerShell](/stories/malicious_powershell/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) |
+| [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](/stories/meterpreter/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
-| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444/) | [Control Panel](/tags/#control-panel), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
-| [NOBELIUM Group](/stories/nobelium_group/) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) |
-| [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services/) | [Forced Authentication](/tags/#forced-authentication), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
-| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [PowerShell](/tags/#powershell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Execution](/tags/#execution) |
-| [ProxyShell](/stories/proxyshell/) | [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [PowerShell](/tags/#powershell) | [Persistence](/tags/#persistence) |
+| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
+| [NOBELIUM Group](/stories/nobelium_group/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
+| [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
+| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Persistence](/tags/#persistence) |
+| [ProxyShell](/stories/proxyshell/) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
 | [SQL Injection](/stories/sql_injection/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [Silver Sparrow](/stories/silver_sparrow/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Data Staged](/tags/#data-staged) | [Command And Control](/tags/#command-and-control) |
-| [Spearphishing Attachments](/stories/spearphishing_attachments/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Security Account Manager](/tags/#security-account-manager), [Spearphishing Link](/tags/#spearphishing-link) | [Initial Access](/tags/#initial-access) |
-| [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) |
+| [Silver Sparrow](/stories/silver_sparrow/) | [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection) |
+| [Spearphishing Attachments](/stories/spearphishing_attachments/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
+| [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity/) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious DNS Traffic](/stories/suspicious_dns_traffic/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
+| [Suspicious DNS Traffic](/stories/suspicious_dns_traffic/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) |
 | [Suspicious Emails](/stories/suspicious_emails/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
-| [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity/) | [Mshta](/tags/#mshta), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Okta Activity](/stories/suspicious_okta_activity/) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity/) | [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity/) | [Rundll32](/tags/#rundll32), [LSASS Memory](/tags/#lsass-memory), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious WMI Use](/stories/suspicious_wmi_use/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) |
-| [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious WMI Use](/stories/suspicious_wmi_use/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) |
+| [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities/) | [Application Shimming](/tags/#application-shimming) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) |
 | [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification), [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning), [Gather Victim Host Information](/tags/#gather-victim-host-information), [System Service Discovery](/tags/#system-service-discovery), [Query Registry](/tags/#query-registry), [Network Service Scanning](/tags/#network-service-scanning), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software Discovery](/tags/#software-discovery), [Software](/tags/#software), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Credentials](/tags/#credentials), [Domain Properties](/tags/#domain-properties), [Network Trust Dependencies](/tags/#network-trust-dependencies), [Account Manipulation](/tags/#account-manipulation), [Vulnerability Scanning](/tags/#vulnerability-scanning), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Impact](/tags/#impact) |
-| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Establish Accounts](/tags/#establish-accounts), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Application Shimming](/tags/#application-shimming), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) |
-| [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Accessibility Features](/tags/#accessibility-features), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) |
+| [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |

docs/_pages/best_practices.md

@@ -12,6 +12,6 @@ sidebar:
 | ----------- | ----------- |--------------|
 | [Asset Tracking]() | None | None |
 | [Monitor for Updates]() | None | None |
-| [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Drive-by Compromise](/tags/#drive-by-compromise), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Web Protocols](/tags/#web-protocols) | [Lateral Movement](/tags/#lateral-movement) |
-| [Router and Infrastructure Security](/stories/router_and_infrastructure_security/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [Man-in-the-Middle](/tags/#man-in-the-middle), [TFTP Boot](/tags/#tftp-boot), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) |
+| [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch/) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) |
+| [Router and Infrastructure Security](/stories/router_and_infrastructure_security/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) |
 | [Use of Cleartext Protocols]() | None | None |

docs/_pages/cloud_security.md

@@ -10,24 +10,24 @@ sidebar:
 
 | Name        | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| [AWS Cross Account Activity](/stories/aws_cross_account_activity/) | [Valid Accounts](/tags/#valid-accounts), [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) |
-| [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation/) | [Cloud Accounts](/tags/#cloud-accounts), [Cloud Account](/tags/#cloud-account), [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force), [Account Manipulation](/tags/#account-manipulation), [Cloud Groups](/tags/#cloud-groups) | [Defense Evasion](/tags/#defense-evasion) |
+| [AWS Cross Account Activity](/stories/aws_cross_account_activity/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) |
+| [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation/) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) |
 | [AWS Network ACL Activity](/stories/aws_network_acl_activity/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) |
 | [AWS Security Hub Alerts]() | None | None |
 | [AWS User Monitoring](/stories/aws_user_monitoring/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
-| [Cloud Cryptomining](/stories/cloud_cryptomining/) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
-| [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse/) | [Valid Accounts](/tags/#valid-accounts), [LSASS Memory](/tags/#lsass-memory), [Cloud Account](/tags/#cloud-account), [Modify Authentication Process](/tags/#modify-authentication-process), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Defense Evasion](/tags/#defense-evasion) |
+| [Cloud Cryptomining](/stories/cloud_cryptomining/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
+| [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Container Implantation Monitoring and Investigation](/stories/container_implantation_monitoring_and_investigation/) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) |
-| [Dev Sec Ops](/stories/dev_sec_ops/) | [Malicious Image](/tags/#malicious-image), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Execution](/tags/#execution) |
+| [Dev Sec Ops](/stories/dev_sec_ops/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [GCP Cross Account Activity](/stories/gcp_cross_account_activity/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
 | [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Sensitive Object Access Activity]() | None | None |
-| [Office 365 Detections](/stories/office_365_detections/) | [Password Guessing](/tags/#password-guessing), [Cloud Account](/tags/#cloud-account), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Modify Authentication Process](/tags/#modify-authentication-process), [Brute Force](/tags/#brute-force), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Remote Email Collection](/tags/#remote-email-collection) | [Credential Access](/tags/#credential-access) |
+| [Office 365 Detections](/stories/office_365_detections/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | [Collection](/tags/#collection) |
 | [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) |
 | [Suspicious AWS Traffic]() | None | None |
 | [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities/) | [Cloud Accounts](/tags/#cloud-accounts), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) |
 | [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | [Discovery](/tags/#discovery) |
+| [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious GCP Storage Activities](/stories/suspicious_gcp_storage_activities/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) |

docs/_pages/lateral_movement.md

@@ -10,4 +10,4 @@ sidebar:
 
 | Name        | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527/) | [Print Processors](/tags/#print-processors), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) |
+| [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |

docs/_pages/malware.md

@@ -10,25 +10,25 @@ sidebar:
 
 | Name        | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| [BlackMatter Ransomware](/stories/blackmatter_ransomware/) | [Credentials in Registry](/tags/#credentials-in-registry), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Credential Access](/tags/#credential-access) |
-| [Clop Ransomware](/stories/clop_ransomware/) | [User Execution](/tags/#user-execution), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Destruction](/tags/#data-destruction), [Service Execution](/tags/#service-execution), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Service Stop](/tags/#service-stop), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Execution](/tags/#execution) |
+| [BlackMatter Ransomware](/stories/blackmatter_ransomware/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
+| [Clop Ransomware](/stories/clop_ransomware/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
 | [ColdRoot MacOS RAT]() | None | None |
-| [DHS Report TA18-074A](/stories/dhs_report_ta18-074a/) | [Local Account](/tags/#local-account), [File Transfer Protocols](/tags/#file-transfer-protocols), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [PowerShell](/tags/#powershell), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry) | [Persistence](/tags/#persistence) |
-| [DarkSide Ransomware](/stories/darkside_ransomware/) | [Security Account Manager](/tags/#security-account-manager), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control) | [Credential Access](/tags/#credential-access) |
-| [Dynamic DNS](/stories/dynamic_dns/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
-| [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Windows Command Shell](/tags/#windows-command-shell), [Software Deployment Tools](/tags/#software-deployment-tools), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Execution](/tags/#execution) |
-| [FIN7](/stories/fin7/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [JavaScript](/tags/#javascript), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Spearphishing Attachment](/tags/#spearphishing-attachment), [XSL Script Processing](/tags/#xsl-script-processing) | [Discovery](/tags/#discovery) |
-| [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [Network Share Connection Removal](/tags/#network-share-connection-removal), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [File Transfer Protocols](/tags/#file-transfer-protocols), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Defense Evasion](/tags/#defense-evasion) |
-| [IcedID](/stories/icedid/) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) |
-| [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) |
-| [Ransomware](/stories/ransomware/) | [Archive via Utility](/tags/#archive-via-utility), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Service Stop](/tags/#service-stop), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [CMSTP](/tags/#cmstp), [File Deletion](/tags/#file-deletion), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Account Access Removal](/tags/#account-access-removal), [Service Execution](/tags/#service-execution), [Visual Basic](/tags/#visual-basic), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Scheduled Task](/tags/#scheduled-task), [Rename System Utilities](/tags/#rename-system-utilities), [Web Protocols](/tags/#web-protocols), [Msiexec](/tags/#msiexec) | [Collection](/tags/#collection) |
+| [DHS Report TA18-074A](/stories/dhs_report_ta18-074a/) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
+| [DarkSide Ransomware](/stories/darkside_ransomware/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Dynamic DNS](/stories/dynamic_dns/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) |
+| [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
+| [FIN7](/stories/fin7/) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
+| [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) |
+| [IcedID](/stories/icedid/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |
+| [Ransomware](/stories/ransomware/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Ransomware Cloud](/stories/ransomware_cloud/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
-| [Remcos](/stories/remcos/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Revil Ransomware](/stories/revil_ransomware/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) |
-| [Ryuk Ransomware](/stories/ryuk_ransomware/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Destruction](/tags/#data-destruction), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Command Shell](/tags/#windows-command-shell), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) |
-| [SamSam Ransomware](/stories/samsam_ransomware/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
-| [Trickbot](/stories/trickbot/) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) |
-| [Unusual Processes](/stories/unusual_processes/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows File Extension and Association Abuse](/stories/windows_file_extension_and_association_abuse/) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Service Abuse](/stories/windows_service_abuse/) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) |
-| [XMRig](/stories/xmrig/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
+| [Remcos](/stories/remcos/) | [Screen Capture](/tags/#screen-capture) | [Collection](/tags/#collection) |
+| [Revil Ransomware](/stories/revil_ransomware/) | [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) |
+| [Ryuk Ransomware](/stories/ryuk_ransomware/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) |
+| [SamSam Ransomware](/stories/samsam_ransomware/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
+| [Trickbot](/stories/trickbot/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) |
+| [Unusual Processes](/stories/unusual_processes/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
+| [Windows File Extension and Association Abuse](/stories/windows_file_extension_and_association_abuse/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Service Abuse](/stories/windows_service_abuse/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |
+| [XMRig](/stories/xmrig/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |

docs/_pages/playbooks.md

@@ -1,8 +1,13 @@
 ---
 title: "Playbooks"
-layout: single
+layout: collection
 author_profile: false
 permalink: /playbooks/
+classes: wide
+sidebar:
+  nav: "playbooks"
 ---
 
-### Come back soon, work in progress 👷‍♀️ 🏗 ..
+| Name    | Detections | Type        |
+| --------| ---------- | ----------- |
+| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/detections/TTP/conti_common_exec_parameter)| Response |

docs/_pages/stories.md

@@ -10,107 +10,107 @@ sidebar:
 
 | Name    |   Technique |     Tactic   |
 | ----------- | ----------- |--------------|
-| [AWS Cross Account Activity](aws_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts), [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) |
-| [AWS IAM Privilege Escalation](aws_iam_privilege_escalation) | [Cloud Accounts](/tags/#cloud-accounts), [Cloud Account](/tags/#cloud-account), [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force), [Account Manipulation](/tags/#account-manipulation), [Cloud Groups](/tags/#cloud-groups) | [Defense Evasion](/tags/#defense-evasion) |
+| [AWS Cross Account Activity](aws_cross_account_activity) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) |
+| [AWS IAM Privilege Escalation](aws_iam_privilege_escalation) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) |
 | [AWS Network ACL Activity](aws_network_acl_activity) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) |
 | [AWS Security Hub Alerts]() | None | None |
 | [AWS User Monitoring](aws_user_monitoring) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
-| [Active Directory Discovery](active_directory_discovery) | [Domain Account](/tags/#domain-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Domain Groups](/tags/#domain-groups), [Password Policy Discovery](/tags/#password-policy-discovery), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Discovery](/tags/#discovery) |
+| [Active Directory Discovery](active_directory_discovery) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Active Directory Password Spraying](active_directory_password_spraying) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) |
 | [Apache Struts Vulnerability](apache_struts_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Asset Tracking]() | None | None |
-| [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Defense Evasion](/tags/#defense-evasion) |
+| [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Baron Samedit CVE-2021-3156](baron_samedit_cve-2021-3156) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [BlackMatter Ransomware](blackmatter_ransomware) | [Credentials in Registry](/tags/#credentials-in-registry), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Credential Access](/tags/#credential-access) |
+| [BlackMatter Ransomware](blackmatter_ransomware) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
 | [Brand Monitoring]() | None | None |
-| [Clop Ransomware](clop_ransomware) | [User Execution](/tags/#user-execution), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Destruction](/tags/#data-destruction), [Service Execution](/tags/#service-execution), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Service Stop](/tags/#service-stop), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Execution](/tags/#execution) |
-| [Cloud Cryptomining](cloud_cryptomining) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
-| [Cloud Federated Credential Abuse](cloud_federated_credential_abuse) | [Valid Accounts](/tags/#valid-accounts), [LSASS Memory](/tags/#lsass-memory), [Cloud Account](/tags/#cloud-account), [Modify Authentication Process](/tags/#modify-authentication-process), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Defense Evasion](/tags/#defense-evasion) |
-| [Cobalt Strike](cobalt_strike) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) |
+| [Clop Ransomware](clop_ransomware) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
+| [Cloud Cryptomining](cloud_cryptomining) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
+| [Cloud Federated Credential Abuse](cloud_federated_credential_abuse) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Cobalt Strike](cobalt_strike) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [ColdRoot MacOS RAT]() | None | None |
-| [Collection and Staging](collection_and_staging) | [Archive via Utility](/tags/#archive-via-utility), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection), [Masquerading](/tags/#masquerading) | [Collection](/tags/#collection) |
-| [Command and Control](command_and_control) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
+| [Collection and Staging](collection_and_staging) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
+| [Command and Control](command_and_control) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) |
 | [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) |
-| [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Kerberoasting](/tags/#kerberoasting), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access) |
-| [DHS Report TA18-074A](dhs_report_ta18-074a) | [Local Account](/tags/#local-account), [File Transfer Protocols](/tags/#file-transfer-protocols), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [PowerShell](/tags/#powershell), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry) | [Persistence](/tags/#persistence) |
+| [Credential Dumping](credential_dumping) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) |
+| [DHS Report TA18-074A](dhs_report_ta18-074a) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
 | [DNS Amplification Attacks](dns_amplification_attacks) | [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) |
 | [DNS Hijacking](dns_hijacking) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) |
-| [DarkSide Ransomware](darkside_ransomware) | [Security Account Manager](/tags/#security-account-manager), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control) | [Credential Access](/tags/#credential-access) |
-| [Data Exfiltration](data_exfiltration) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
+| [DarkSide Ransomware](darkside_ransomware) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Data Exfiltration](data_exfiltration) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) |
 | [Data Protection](data_protection) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) |
 | [Deobfuscate-Decode Files or Information](deobfuscate-decode_files_or_information) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) |
-| [Detect Zerologon Attack](detect_zerologon_attack) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services), [LSASS Memory](/tags/#lsass-memory), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Lateral Movement](/tags/#lateral-movement) |
-| [Dev Sec Ops](dev_sec_ops) | [Malicious Image](/tags/#malicious-image), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Execution](/tags/#execution) |
-| [Disabling Security Tools](disabling_security_tools) | [Install Root Certificate](/tags/#install-root-certificate), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows Service](/tags/#windows-service), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
-| [Domain Trust Discovery](domain_trust_discovery) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
-| [Dynamic DNS](dynamic_dns) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
-| [Emotet Malware  DHS Report TA18-201A ](emotet_malware__dhs_report_ta18-201a_) | [Windows Command Shell](/tags/#windows-command-shell), [Software Deployment Tools](/tags/#software-deployment-tools), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Execution](/tags/#execution) |
+| [Detect Zerologon Attack](detect_zerologon_attack) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
+| [Dev Sec Ops](dev_sec_ops) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
+| [Disabling Security Tools](disabling_security_tools) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) |
+| [Domain Trust Discovery](domain_trust_discovery) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
+| [Dynamic DNS](dynamic_dns) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) |
+| [Emotet Malware  DHS Report TA18-201A ](emotet_malware__dhs_report_ta18-201a_) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
 | [F5 TMUI RCE CVE-2020-5902](f5_tmui_rce_cve-2020-5902) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [FIN7](fin7) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [JavaScript](/tags/#javascript), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Spearphishing Attachment](/tags/#spearphishing-attachment), [XSL Script Processing](/tags/#xsl-script-processing) | [Discovery](/tags/#discovery) |
+| [FIN7](fin7) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
 | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
-| [HAFNIUM Group](hafnium_group) | [PowerShell](/tags/#powershell), [Web Shell](/tags/#web-shell), [Local Account](/tags/#local-account), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [LSASS Memory](/tags/#lsass-memory), [Remote Email Collection](/tags/#remote-email-collection), [NTDS](/tags/#ntds), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Execution](/tags/#execution) |
-| [Hidden Cobra Malware](hidden_cobra_malware) | [Network Share Connection Removal](/tags/#network-share-connection-removal), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [File Transfer Protocols](/tags/#file-transfer-protocols), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Defense Evasion](/tags/#defense-evasion) |
-| [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) |
-| [Ingress Tool Transfer](ingress_tool_transfer) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) |
+| [HAFNIUM Group](hafnium_group) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
+| [Hidden Cobra Malware](hidden_cobra_malware) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) |
+| [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Ingress Tool Transfer](ingress_tool_transfer) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) |
 | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Sensitive Object Access Activity]() | None | None |
-| [Lateral Movement](lateral_movement) | [Pass the Hash](/tags/#pass-the-hash), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [Kerberoasting](/tags/#kerberoasting), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Scheduled Task](/tags/#scheduled-task) | [Defense Evasion](/tags/#defense-evasion) |
-| [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) |
-| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
+| [Lateral Movement](lateral_movement) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Malicious PowerShell](malicious_powershell) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) |
+| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](meterpreter) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
-| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Control Panel](/tags/#control-panel), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
+| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
 | [Monitor for Updates]() | None | None |
-| [NOBELIUM Group](nobelium_group) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) |
+| [NOBELIUM Group](nobelium_group) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
 | [Netsh Abuse](netsh_abuse) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | [Defense Evasion](/tags/#defense-evasion) |
-| [Office 365 Detections](office_365_detections) | [Password Guessing](/tags/#password-guessing), [Cloud Account](/tags/#cloud-account), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Modify Authentication Process](/tags/#modify-authentication-process), [Brute Force](/tags/#brute-force), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Remote Email Collection](/tags/#remote-email-collection) | [Credential Access](/tags/#credential-access) |
-| [Orangeworm Attack Group](orangeworm_attack_group) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) |
-| [PetitPotam NTLM Relay on Active Directory Certificate Services](petitpotam_ntlm_relay_on_active_directory_certificate_services) | [Forced Authentication](/tags/#forced-authentication), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
-| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [PowerShell](/tags/#powershell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Execution](/tags/#execution) |
-| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Print Processors](/tags/#print-processors), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) |
-| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Drive-by Compromise](/tags/#drive-by-compromise), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Web Protocols](/tags/#web-protocols) | [Lateral Movement](/tags/#lateral-movement) |
-| [ProxyShell](proxyshell) | [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [PowerShell](/tags/#powershell) | [Persistence](/tags/#persistence) |
-| [Ransomware](ransomware) | [Archive via Utility](/tags/#archive-via-utility), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Service Stop](/tags/#service-stop), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [CMSTP](/tags/#cmstp), [File Deletion](/tags/#file-deletion), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Account Access Removal](/tags/#account-access-removal), [Service Execution](/tags/#service-execution), [Visual Basic](/tags/#visual-basic), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Scheduled Task](/tags/#scheduled-task), [Rename System Utilities](/tags/#rename-system-utilities), [Web Protocols](/tags/#web-protocols), [Msiexec](/tags/#msiexec) | [Collection](/tags/#collection) |
+| [Office 365 Detections](office_365_detections) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | [Collection](/tags/#collection) |
+| [Orangeworm Attack Group](orangeworm_attack_group) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |
+| [PetitPotam NTLM Relay on Active Directory Certificate Services](petitpotam_ntlm_relay_on_active_directory_certificate_services) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
+| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Persistence](/tags/#persistence) |
+| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
+| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) |
+| [ProxyShell](proxyshell) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
+| [Ransomware](ransomware) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Ransomware Cloud](ransomware_cloud) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
-| [Remcos](remcos) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Revil Ransomware](revil_ransomware) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) |
-| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [Man-in-the-Middle](/tags/#man-in-the-middle), [TFTP Boot](/tags/#tftp-boot), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) |
-| [Ryuk Ransomware](ryuk_ransomware) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Destruction](/tags/#data-destruction), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Command Shell](/tags/#windows-command-shell), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) |
+| [Remcos](remcos) | [Screen Capture](/tags/#screen-capture) | [Collection](/tags/#collection) |
+| [Revil Ransomware](revil_ransomware) | [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) |
+| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) |
+| [Ryuk Ransomware](ryuk_ransomware) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) |
 | [SQL Injection](sql_injection) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [SamSam Ransomware](samsam_ransomware) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
-| [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Data Staged](/tags/#data-staged) | [Command And Control](/tags/#command-and-control) |
-| [Spearphishing Attachments](spearphishing_attachments) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Security Account Manager](/tags/#security-account-manager), [Spearphishing Link](/tags/#spearphishing-link) | [Initial Access](/tags/#initial-access) |
+| [SamSam Ransomware](samsam_ransomware) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
+| [Silver Sparrow](silver_sparrow) | [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection) |
+| [Spearphishing Attachments](spearphishing_attachments) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
 | [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious AWS S3 Activities](suspicious_aws_s3_activities) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) |
 | [Suspicious AWS Traffic]() | None | None |
 | [Suspicious Cloud Authentication Activities](suspicious_cloud_authentication_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Cloud Instance Activities](suspicious_cloud_instance_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious Cloud Instance Activities](suspicious_cloud_instance_activities) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) |
 | [Suspicious Cloud Provisioning Activities](suspicious_cloud_provisioning_activities) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Cloud User Activities](suspicious_cloud_user_activities) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | [Discovery](/tags/#discovery) |
-| [Suspicious Command-Line Executions](suspicious_command-line_executions) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) |
+| [Suspicious Cloud User Activities](suspicious_cloud_user_activities) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious Command-Line Executions](suspicious_command-line_executions) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Compiled HTML Activity](suspicious_compiled_html_activity) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious DNS Traffic](suspicious_dns_traffic) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
+| [Suspicious DNS Traffic](suspicious_dns_traffic) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) |
 | [Suspicious Emails](suspicious_emails) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
 | [Suspicious GCP Storage Activities](suspicious_gcp_storage_activities) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) |
-| [Suspicious MSHTA Activity](suspicious_mshta_activity) | [Mshta](/tags/#mshta), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious MSHTA Activity](suspicious_mshta_activity) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Okta Activity](suspicious_okta_activity) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Regsvcs Regasm Activity](suspicious_regsvcs_regasm_activity) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Regsvr32 Activity](suspicious_regsvr32_activity) | [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Rundll32](/tags/#rundll32), [LSASS Memory](/tags/#lsass-memory), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious WMI Use](suspicious_wmi_use) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Suspicious Zoom Child Processes](suspicious_zoom_child_processes) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) |
-| [Trickbot](trickbot) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) |
-| [Trusted Developer Utilities Proxy Execution](trusted_developer_utilities_proxy_execution) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious WMI Use](suspicious_wmi_use) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) |
+| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Application Shimming](/tags/#application-shimming) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Suspicious Zoom Child Processes](suspicious_zoom_child_processes) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Trickbot](trickbot) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) |
+| [Trusted Developer Utilities Proxy Execution](trusted_developer_utilities_proxy_execution) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) |
 | [Trusted Developer Utilities Proxy Execution MSBuild](trusted_developer_utilities_proxy_execution_msbuild) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
-| [Unusual Processes](unusual_processes) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
+| [Unusual Processes](unusual_processes) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
 | [Use of Cleartext Protocols]() | None | None |
 | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Discovery Techniques](windows_discovery_techniques) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification), [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning), [Gather Victim Host Information](/tags/#gather-victim-host-information), [System Service Discovery](/tags/#system-service-discovery), [Query Registry](/tags/#query-registry), [Network Service Scanning](/tags/#network-service-scanning), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software Discovery](/tags/#software-discovery), [Software](/tags/#software), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Credentials](/tags/#credentials), [Domain Properties](/tags/#domain-properties), [Network Trust Dependencies](/tags/#network-trust-dependencies), [Account Manipulation](/tags/#account-manipulation), [Vulnerability Scanning](/tags/#vulnerability-scanning), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Log Manipulation](windows_log_manipulation) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Impact](/tags/#impact) |
-| [Windows Persistence Techniques](windows_persistence_techniques) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Establish Accounts](/tags/#establish-accounts), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Application Shimming](/tags/#application-shimming), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) |
-| [Windows Privilege Escalation](windows_privilege_escalation) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Accessibility Features](/tags/#accessibility-features), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Windows Service Abuse](windows_service_abuse) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) |
-| [XMRig](xmrig) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Discovery Techniques](windows_discovery_techniques) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) |
+| [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Log Manipulation](windows_log_manipulation) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Windows Privilege Escalation](windows_privilege_escalation) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |
+| [XMRig](xmrig) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |

docs/_playbooks/ransomware_investigate_and_contain.md

@@ -0,0 +1,686 @@
+---
+title: "Ransomware Investigate and Contain"
+last_modified_at: 2018-02-04
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - Carbon Black Response
+  - LDAP
+  - Palo Alto Networks Firewall
+  - WildFire
+  - Cylance
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook investigates and contains ransomware detected on endpoints.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [Carbon Black Response](https://splunkbase.splunk.com/apps/#/search/Carbon Black Response/product/soar), [LDAP](https://splunkbase.splunk.com/apps/#/search/LDAP/product/soar), [Palo Alto Networks Firewall](https://splunkbase.splunk.com/apps/#/search/Palo Alto Networks Firewall/product/soar), [WildFire](https://splunkbase.splunk.com/apps/#/search/WildFire/product/soar), [Cylance](https://splunkbase.splunk.com/apps/#/search/Cylance/product/soar)
+- **Last Updated**: 2018-02-04
+- **Author**: Philip Royer, Splunk
+- **ID**: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
+
+#### Associated Detections
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+* [Conti Common Exec parameter](/detections/TTP/conti_common_exec_parameter)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+#### How To Implement
+This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/ransomware_investigate_and_contain.png)
+
+#### Required field
+* ComputerName
+* Username
+
+
+#### Reference
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/ransomware_investigate_and_contain.yml) \| *version*: **1**

docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md

@@ -5,6 +5,7 @@ categories:
   - Application
 last_modified_at: 2017-09-12
 toc: true
+toc_label: ""
 tags:
   - TTP
   - Splunk Enterprise

docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md

@@ -5,6 +5,7 @@ categories:
   - Network
 last_modified_at: 2017-09-13
 toc: true
+toc_label: ""
 tags:
   - TTP
   - Splunk Enterprise

docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md

@@ -5,6 +5,7 @@ categories:
   - Application
 last_modified_at: 2017-09-15
 toc: true
+toc_label: ""
 tags:
   - Hunting
   - Splunk Enterprise

docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md

@@ -5,6 +5,7 @@ categories:
   - Application
 last_modified_at: 2017-09-19
 toc: true
+toc_label: ""
 tags:
   - Anomaly
   - Splunk Enterprise

docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md

@@ -5,6 +5,7 @@ categories:
   - Network
 last_modified_at: 2017-09-20
 toc: true
+toc_label: ""
 tags:
   - Anomaly
   - T1498.002
@@ -37,8 +38,8 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS
 
 #### ATT&CK
 
-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1498.002](https://attack.mitre.org/techniques/T1498/002/) | Reflection Amplification | Impact |
 
 

docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md

@@ -5,6 +5,7 @@ categories:
   - Web
 last_modified_at: 2017-09-23
 toc: true
+toc_label: ""
 tags:
   - TTP
   - T1082
@@ -37,8 +38,8 @@ This search looks for specific GET or HEAD requests to web servers that are indi
 
 #### ATT&CK
 
-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |
 
 

docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md

@@ -5,6 +5,7 @@ categories:
   - Web
 last_modified_at: 2017-09-23
 toc: true
+toc_label: ""
 tags:
   - TTP
   - Splunk Enterprise

docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md

@@ -5,6 +5,7 @@ categories:
   - Web
 last_modified_at: 2017-09-23
 toc: true
+toc_label: ""
 tags:
   - TTP
   - Splunk Enterprise

docs/_posts/2017-10-13-unusually_long_content-type_length.md

@@ -5,6 +5,7 @@ categories:
   - Network
 last_modified_at: 2017-10-13
 toc: true
+toc_label: ""
 tags:
   - Anomaly
   - Splunk Enterprise

docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md

@@ -5,6 +5,7 @@ categories:
   - Application
 last_modified_at: 2018-01-05
 toc: true
+toc_label: ""
 tags:
   - TTP
   - Splunk Enterprise

docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md

@@ -5,6 +5,7 @@ categories:
   - Cloud
 last_modified_at: 2018-05-07
 toc: true
+toc_label: ""
 tags:
   - Anomaly
   - Splunk Enterprise

docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md

@@ -5,6 +5,7 @@ categories:
   - Network
 last_modified_at: 2018-06-01
 toc: true
+toc_label: ""
 tags:
   - TTP
   - T1095
@@ -37,8 +38,8 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000
 
 #### ATT&CK
 
-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1095](https://attack.mitre.org/techniques/T1095/) | Non-Application Layer Protocol | Command And Control |
 
 

docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md

@@ -5,6 +5,7 @@ categories:
   - Cloud
 last_modified_at: 2018-06-28
 toc: true
+toc_label: ""
 tags:
   - Anomaly
   - T1530
@@ -36,8 +37,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen
 
 #### ATT&CK
 
-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
 
 

docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md

@@ -5,6 +5,7 @@ categories:
   - Cloud
 last_modified_at: 2018-10-12
 toc: true
+toc_label: ""
 tags:
   - Anomaly
   - Splunk Security Analytics for AWS

docs/_posts/2018-10-23-wmi_permanent_event_subscription.md

@@ -5,6 +5,7 @@ categories:
   - Endpoint
 last_modified_at: 2018-10-23
 toc: true
+toc_label: ""
 tags:
   - TTP
   - T1047
@@ -36,8 +37,8 @@ This search looks for the creation of WMI permanent event subscriptions.
 
 #### ATT&CK
 
-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
 
 

docs/_posts/2018-10-23-wmi_temporary_event_subscription.md

@@ -5,6 +5,7 @@ categories:
   - Endpoint
 last_modified_at: 2018-10-23
 toc: true
+toc_label: ""
 tags:
   - TTP
   - T1047
@@ -36,8 +37,8 @@ This search looks for the creation of WMI temporary event subscriptions.
 
 #### ATT&CK
 
-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
 
 

docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md

@@ -5,6 +5,7 @@ categories:
   - Cloud
 last_modified_at: 2018-11-27
 toc: true
+toc_label: ""
 tags:
   - Anomaly
   - T1530
@@ -36,8 +37,8 @@ This search detects users creating spikes in API activity related to deletion of
 
 #### ATT&CK
 
-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
 
 

docs/_posts/2018-12-03-remote_wmi_command_attempt.md

@@ -5,6 +5,7 @@ categories:
   - Endpoint
 last_modified_at: 2018-12-03
 toc: true
+toc_label: ""
 tags:
   - TTP
   - T1047
@@ -35,8 +36,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote
 
 #### ATT&CK
 
-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
 
 

docs/_posts/2018-12-03-usn_journal_deletion.md

@@ -5,6 +5,7 @@ categories:
   - Endpoint
 last_modified_at: 2018-12-03
 toc: true
+toc_label: ""
 tags:
   - TTP
   - T1070
@@ -35,8 +36,8 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks
 
 #### ATT&CK
 
-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |