diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index 33a550c1eb..f379cdd4fe 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -455,6 +455,14 @@ jobs: source venv/bin/activate python3 bin/doc_gen.py --path . --output docs -v + - name: Enrich detections with TAs + env: + GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_ACCESS_TOKEN }} + run: | + source venv/bin/activate + python3 -m pip install security_content_automation/requirements.txt + python3 security_content_automation/enrich_detections.py + - name: Make YAMLs Pretty run: | source venv/bin/activate diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 13c1671a13..40b8bb9eb4 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -75,7 +75,7 @@ publish_build_to_pre_qa: script: - mkdir -p artifacts - pip install requests - - python security_content_automation/publish_build_to_pre_qa/publish_build_to_pre_qa.py --version $CI_COMMIT_REF_NAME --builds DA-ESS_AmazonWebServices_Content DA-ESS-ContentUpdate + - python security_content_automation/publish_build_to_pre_qa/publish_build_to_pre_qa.py --version $CI_COMMIT_REF_NAME --builds DA-ESS-ContentUpdate after_script: - cp publish_build_to_pre_qa.log artifacts/publish_build_to_pre_qa.log rules: diff --git a/README.md b/README.md index 96278f9112..0e7dc602f3 100644 --- a/README.md +++ b/README.md @@ -97,6 +97,9 @@ A complete use case, specifically built to detect, investigate, and respond to a * [dashboards/](dashboards/): JSON definitions of Mission Control dashboards, to be used as a response task. Currently not used. * [macros/](macros/): Implements Splunk’s search macros, shortcuts to commonly used search patterns like sysmon source type. More on how macros are used to customize content below. * [lookups/](lookups/): Implements Splunk’s lookup, usually to provide a list of static values like commonly used ransomware extensions. +* [security_content_automation/](security_content_automation/): It contains script for enriching detection with relevant supported TAs and also contains script for publishing release build to [Pre-QA artifactory](https://repo.splunk.com/artifactory/Solutions/DA/Pre-QA/) on every tag release. + + # Contribution 🥰 We welcome feedback and contributions from the community! Please see our [contributing to the project](https://github.com/splunk/security_content/wiki/Contributing-to-the-Project) for more information on how to get involved. diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 71e463fbf9..df978db766 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -66,3 +66,5 @@ tags: - All_Changes.status risk_score: 15 security_domain: network + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index 1228ec4926..cb1a2b9c7a 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -72,3 +72,5 @@ tags: - All_Changes.user risk_score: 15 security_domain: network + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index 0e1e20e231..f49fce8cf9 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -68,3 +68,5 @@ tags: - All_Changes.object risk_score: 36 security_domain: threat + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index 43c8ea2de0..0410a7370e 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -69,3 +69,5 @@ tags: - All_Changes.vendor_region risk_score: 18 security_domain: threat + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index d8eace9970..f61886e671 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -74,3 +74,5 @@ tags: - All_Changes.user risk_score: 42 security_domain: threat + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 2fba8e45a1..5b4851a0ae 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -69,3 +69,5 @@ tags: - All_Changes.user risk_score: 36 security_domain: threat + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index b9c490d31a..1498019242 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -69,3 +69,5 @@ tags: - All_Changes.user risk_score: 30 security_domain: threat + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index f05c111905..da2a51b79e 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -71,3 +71,5 @@ tags: - All_Changes.user risk_score: 42 security_domain: threat + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index f7bd2b975f..3299a3f417 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -90,3 +90,5 @@ tags: - All_Changes.command risk_score: 18 security_domain: threat + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index 55f253f01f..daeaf8d490 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -90,3 +90,5 @@ tags: - All_Changes.command risk_score: 42 security_domain: threat + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index d2bf729211..754efaf604 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -89,3 +89,5 @@ tags: - All_Changes.command risk_score: 42 security_domain: threat + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index b6b89f2f7a..ac3797daba 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -90,3 +90,5 @@ tags: - All_Changes.command risk_score: 42 security_domain: threat + supported_tas: + - Splunk_TA_aws-kinesis-firehose diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index 722368e8b8..f5c8857b30 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -80,3 +80,5 @@ tags: - Processes.parent_process_id risk_score: 5 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index f35ad265fb..86071ff0f0 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -76,3 +76,5 @@ tags: - Registry.registry_value_name risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 36c48573a3..52aae5c92b 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -69,3 +69,5 @@ tags: - Registry.dest risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index d75c943cd9..be1e38c53e 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -76,3 +76,5 @@ tags: - Processes.parent_process_id risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 61844a9fb4..41bc3e37ff 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -55,3 +55,5 @@ tags: - Processes.process_path - Processes.parent_process_id security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 4252ceadb4..10d10e646c 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -74,3 +74,5 @@ tags: - Registry.user risk_score: 3 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index a704470b3f..87fcccb2b4 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -57,3 +57,5 @@ tags: - Processes.process_path - Processes.parent_process_id security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index a557dbe759..06d6b5dcc7 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -74,3 +74,5 @@ tags: - Registry.dest risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index a9e51c4f46..481f9a8198 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -82,3 +82,5 @@ tags: - Processes.parent_process_id risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 640444b0cf..ea941bfa39 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -88,3 +88,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 6de61407fb..0b89645de4 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -82,3 +82,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 31c92eb788..f29439bb45 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index 2d327cc01e..7c871d858f 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index fe2fd4b662..4e742ebb72 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -92,3 +92,5 @@ tags: - Processes.parent_process_id risk_score: 20 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index c3778c3143..da30681035 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index f5079e91dd..7041013f6a 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -69,3 +69,5 @@ tags: - Registry.dest risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 1e1cceeded..6461f64403 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -83,3 +83,5 @@ tags: - Processes.dest risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml index 2240c701d5..4bc260d08d 100644 --- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -65,3 +65,5 @@ tags: - Processes.user risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 789fe40bca..fd4eacf029 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -75,3 +75,5 @@ tags: - Processes.user risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 44262d9858..1f32249fd9 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index 241dae1127..740f549f79 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -92,3 +92,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 34dd2735d6..091aa6f61e 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index 1a61ded17f..aa671b6eb9 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -85,3 +85,5 @@ tags: - Processes.parent_process_id risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index 4316a29554..45ba783055 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -74,3 +74,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 48babdb840..9a0cfa8f5d 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -85,3 +85,5 @@ tags: - Processes.parent_process_id risk_score: 40 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index a64c0c0597..282c29c085 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -66,3 +66,5 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml index 0b1d96da8b..90f758f46d 100644 --- a/detections/endpoint/change_to_safe_mode_with_network_config.yml +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -64,3 +64,5 @@ tags: - Processes.user risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index e43834eb01..20d3b7f612 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -65,3 +65,5 @@ tags: - Processes.user risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index 5b072f7c71..5f95a83096 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -77,3 +77,5 @@ tags: - Processes.parent_process_id risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index 57972f397f..ea8701cc6e 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -81,3 +81,5 @@ tags: - Processes.parent_process_id risk_score: 100 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index 4b39807d71..d2e19bae02 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index 36918e047d..ca1384fc22 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -87,3 +87,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index e431e4767b..5512203ac6 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -78,3 +78,5 @@ tags: - Processes.parent_process_id risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index caf4bf6d2a..13e215abb1 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 5c42674597..ca3390c2f4 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 30 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 57a2ce24f5..af27466036 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -83,3 +83,5 @@ tags: - Processes.parent_process_id risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 9d6834c7db..bc3f53bc27 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 81 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index 74bf3b4f5d..52b61c246c 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -82,3 +82,5 @@ tags: - Processes.parent_process_id risk_score: 81 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index 85bd4e7891..982bb93c5f 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 81 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 9efa0420bb..e7e11cc09c 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -82,3 +82,5 @@ tags: - Processes.parent_process_id risk_score: 81 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index 65ae091a01..4e4527f998 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -81,3 +81,5 @@ tags: - Processes.parent_process_id risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 90136285c4..99741805d5 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -88,3 +88,5 @@ tags: - Processes.parent_process_id risk_score: 81 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index 609fee47b8..2c4baed941 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 6f2e31b762..5795b04f12 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -94,3 +94,5 @@ tags: - Filesystem.user risk_score: 81 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index 297d53a3ba..ec49b6d6db 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -94,3 +94,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 1ee0da1045..4714a277ec 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -98,3 +98,5 @@ tags: - Processes.parent_process_id risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index b339a00b1b..1b6c30f710 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -95,3 +95,5 @@ tags: - Processes.parent_process_id risk_score: 72 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index aa378f0c38..499ad568b5 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -90,3 +90,5 @@ tags: - Processes.parent_process_id risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index c49ff33249..180b73585e 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -91,3 +91,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 48dc4eac69..cd4be52fb9 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -85,3 +85,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index 7228b8d762..fc25eaa2bc 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -88,3 +88,5 @@ tags: - Processes.parent_process_id risk_score: 32 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index a8f9c6fc3c..226b47f814 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -94,3 +94,5 @@ tags: - Processes.parent_process_id risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 0417b7d8c3..5e172ae5d8 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -84,3 +84,5 @@ tags: - Processes.original_file_name risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index 5ced5f0e85..d7c71727dc 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -87,3 +87,5 @@ tags: - Processes.parent_process_id risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index e7e3af15e3..258427a5e9 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -89,3 +89,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index 489c891e99..cc9286fe4a 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index f12af4889a..12558d8096 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -89,3 +89,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index d9c60a5d52..a346085832 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -96,3 +96,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index 95e6971170..ea505ebdbf 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -95,3 +95,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index a50999441c..1bd63ea426 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -93,3 +93,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index d7be020574..5be793a4fb 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -95,3 +95,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index b25022b50a..0ce3298538 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -81,3 +81,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index ae13c1ce47..c884eb7f88 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -71,3 +71,5 @@ tags: - Processes.parent_process_id risk_score: 24 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index 01e9367191..02400d37b8 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -80,3 +80,5 @@ tags: - Processes.parent_process_id risk_score: 24 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index 134409ee6a..b56f9aa201 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -67,3 +67,5 @@ tags: - Processes.dest risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 22234c482b..9387e05324 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -55,3 +55,5 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index e40fe53195..1561147480 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -71,3 +71,5 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index bd97d5d414..dbfea7ede7 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -70,3 +70,5 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index cd7a294eaa..970291b826 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -70,3 +70,5 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 468cb03887..370a57cfc1 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -71,3 +71,5 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 98f171623a..99325b43e3 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -69,3 +69,5 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index 3bc68fd9ea..725608f220 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -69,3 +69,5 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 9c24bc8265..b29449cebb 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -54,3 +54,5 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index e4f7d51475..42a6106f04 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -61,3 +61,5 @@ tags: - Processes.process_guid risk_score: 24 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index bdcbb8d1e1..39f23f330c 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -68,3 +68,5 @@ tags: - Registry.registry_value_name risk_score: 40 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml index 282f5f47ce..9a5bce2c78 100644 --- a/detections/endpoint/disable_schedule_task.yml +++ b/detections/endpoint/disable_schedule_task.yml @@ -60,3 +60,5 @@ tags: - Processes.dest risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 38e5f85a85..8ff1bc575c 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -70,3 +70,5 @@ tags: - Registry.registry_value_data risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 06b21b3b9a..a8f72f0663 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -74,3 +74,5 @@ tags: - Registry.registry_value_data risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 389c13249b..e65a348ce7 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -69,3 +69,5 @@ tags: - Registry.dest Registry.user risk_score: 40 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index af882858ca..2117620028 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -75,3 +75,5 @@ tags: - Registry.registry_value_name risk_score: 40 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 018f519f8a..6352615096 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -72,3 +72,5 @@ tags: - Registry.registry_value_name risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 6c95b48f7c..1e511acb0e 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -71,3 +71,5 @@ tags: - Registry.registry_value_name risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 56601bec71..954a4147b9 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -72,3 +72,5 @@ tags: - Registry.registry_value_data risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index 14bd3ece53..dd4de0a3cd 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -71,3 +71,5 @@ tags: - Processes.parent_process_id risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index e03f2ee78f..c048edf698 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -78,3 +78,5 @@ tags: - Processes.parent_process_id risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index ecca959049..cf96acc806 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -75,3 +75,5 @@ tags: - Registry.registry_value_name risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index bd64c090db..02bf9ee4e6 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -74,3 +74,5 @@ tags: - Registry.registry_value_name risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index e90cdf51f6..dea2692223 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -73,3 +73,5 @@ tags: - Registry.registry_value_name risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 2320781457..739eb1ad54 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -85,3 +85,5 @@ tags: - Processes.parent_process_id risk_score: 72 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml index a7d03f7b80..d08b791f3f 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -70,3 +70,5 @@ tags: - Processes.parent_process_name risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index 040d016318..5069bf4f2a 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -71,3 +71,5 @@ tags: - Processes.parent_process_name risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml index 700712c009..f44aa2ab73 100644 --- a/detections/endpoint/domain_controller_discovery_with_nltest.yml +++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml @@ -63,3 +63,5 @@ tags: - Processes.parent_process_id risk_score: 21 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 030da0c875..ae07891213 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -93,3 +93,5 @@ tags: - Processes.parent_process_id risk_score: 72 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index ee1428e64c..f0806cf1a4 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index c8b3d080d8..ac76cbe814 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -89,3 +89,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml index c69c5ffe53..5f4c9e0fb8 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/endpoint/elevated_group_discovery_with_net.yml @@ -70,3 +70,5 @@ tags: - Processes.parent_process_id risk_score: 21 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml index bab8fab7ba..bf92cb2add 100644 --- a/detections/endpoint/elevated_group_discovery_with_wmic.yml +++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml @@ -68,3 +68,5 @@ tags: - Processes.parent_process_id risk_score: 21 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index b575508e9e..3ad2ad5db9 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -68,3 +68,5 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index fd7f939d40..cc55d2f898 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -75,3 +75,5 @@ tags: - Registry.registry_value_data risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 38e560cc51..041d54c3a3 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -75,3 +75,5 @@ tags: - Registry.registry_value_data risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index b9672d1073..d86049b7dc 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -78,3 +78,5 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index b853bffe4d..b838d060fa 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -82,3 +82,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index f4b3a41258..7726131774 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -64,3 +64,5 @@ tags: - Processes.user risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml index 2e5c421b97..31e7e9cd42 100644 --- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml +++ b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml @@ -58,3 +58,5 @@ tags: - Processes.user risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_windows diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 13477b9ca3..bac83efcff 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -73,3 +73,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index d993f89216..4ddb7bef7a 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -67,3 +67,5 @@ tags: - Processes.user risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_windows diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 4dda001358..6c46da14ca 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -72,3 +72,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 2875822434..4bac489fdd 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -64,3 +64,5 @@ tags: - Processes.user risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 90d4e076d0..107c0ce90d 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -76,3 +76,5 @@ tags: - Processes.parent_process_id risk_score: 28 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 116d72a6d9..8f76b5ab68 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -68,3 +68,5 @@ tags: - Processes.process_id risk_score: 28 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index d1a27b6e56..ee081a33d7 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -79,3 +79,5 @@ tags: - Filesystem.user risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 2ca3561bc3..9a8c8241a2 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -74,3 +74,5 @@ tags: - Processes.user risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index fdecc0cb1d..42dcd578c5 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -74,3 +74,5 @@ tags: - Processes.parent_process risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml index 474f424a7e..cb08f69826 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/endpoint/extraction_of_registry_hives.yml @@ -78,3 +78,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index df1c06f03b..bd44cb5cf9 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -69,3 +69,5 @@ tags: - Filesystem.file_name risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index ff4576a1d8..d76c1302c7 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -67,3 +67,5 @@ tags: - Processes.parent_process_id risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index 6586eae065..a92768317f 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 81 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index cc936a0de6..53787bc8c5 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -57,3 +57,5 @@ tags: - Processes.parent_process risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml index cfc2477bea..ff29d907d3 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -71,3 +71,5 @@ tags: - Processes.parent_process_name risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index e14cb2c8ee..a47bfa8f2e 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -71,3 +71,5 @@ tags: - Processes.parent_process_name risk_score: 30 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml index f0ca412207..549a7639fb 100644 --- a/detections/endpoint/get_domaintrust_with_powershell.yml +++ b/detections/endpoint/get_domaintrust_with_powershell.yml @@ -71,3 +71,5 @@ tags: - Processes.parent_process_id risk_score: 12 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index 6ec2b802dc..2977e9943a 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -71,3 +71,5 @@ tags: - Processes.parent_process_name risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml index b03dd70b8d..3a7aed21ae 100644 --- a/detections/endpoint/get_foresttrust_with_powershell.yml +++ b/detections/endpoint/get_foresttrust_with_powershell.yml @@ -72,3 +72,5 @@ tags: - Processes.parent_process_id risk_score: 12 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/getdomaincomputer_with_powershell.yml b/detections/endpoint/getdomaincomputer_with_powershell.yml index d468863479..4da1c3199e 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell.yml @@ -63,3 +63,5 @@ tags: - Processes.parent_process_id risk_score: 24 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index 9ac798505f..e3797d79ed 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -65,3 +65,5 @@ tags: - Processes.parent_process_id risk_score: 15 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml index 235c52a3a7..71659ca87e 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml @@ -64,3 +64,5 @@ tags: - Processes.parent_process_id risk_score: 21 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml index eaa34c8215..37f46c9956 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml @@ -67,3 +67,5 @@ tags: - Processes.parent_process_id risk_score: 15 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml index 26e14b6cd0..9b10a7f427 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -73,3 +73,5 @@ tags: - Processes.parent_process_name risk_score: 25 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 704af4fb7f..eac5da28f8 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -79,3 +79,5 @@ tags: - Registry.dest Registry.user risk_score: 72 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index ba70ca1892..8d475b0572 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -74,3 +74,5 @@ tags: - Processes.dest risk_score: 72 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index a1ca235169..b83fcbeec1 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -65,3 +65,5 @@ tags: - Processes.process risk_score: 72 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index f4634552a4..c7d56e34d4 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -65,3 +65,5 @@ tags: - Processes.process risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 8f6faa77bf..0668bed541 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -81,3 +81,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 6f7e6da5d8..ab7430fa8c 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -69,3 +69,5 @@ tags: - Processes.user risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index 9c14a26fb5..cce4592702 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -64,3 +64,5 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index f984d5eae3..23a31dc47e 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -79,3 +79,5 @@ tags: - Processes.parent_process_id risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index dd40105004..1fa77cee67 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -77,3 +77,5 @@ tags: - Processes.parent_process_id risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml index b49f8879df..aab3e5935e 100644 --- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -79,3 +79,5 @@ tags: - Processes.parent_process_id risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index 5ab781c9ea..5f41d4c5c9 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -62,3 +62,5 @@ tags: - Processes.process_id risk_score: 32 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index ffe8f6cdf9..4880410409 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -69,3 +69,5 @@ tags: - Processes.user risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index 9dce88003b..04b24fdeed 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -72,3 +72,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index c172950f46..c4f72a52aa 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -47,3 +47,5 @@ tags: - Filesystem.user - Filesystem.file_path security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index 146efd14ce..6dfef1bea5 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -65,3 +65,5 @@ tags: - Registry.dest risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index 5c14627938..e4858581cd 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -72,3 +72,5 @@ tags: - Processes.parent_process_id risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index bc0b860d30..0351a8b0cc 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -75,3 +75,5 @@ tags: - Processes.parent_process_id risk_score: 15 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 0b7c18eac7..aa6664ba7e 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -78,3 +78,5 @@ tags: - Processes.parent_process_id risk_score: 50 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index 8b21933453..7cee8cbf6d 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -67,3 +67,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index c2d07499f1..30f2fa1600 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -68,3 +68,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index 79eac14dc6..f3d8d1fa01 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -67,3 +67,5 @@ tags: - Processes.parent_process_id risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index 5745a10a4a..69de3a2862 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -73,3 +73,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index dd2294d824..094bebf61f 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -78,3 +78,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index 0e0d0e94fe..0326a05e7a 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -78,3 +78,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index d838666728..5c136fd5a4 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -78,3 +78,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index e2dfd12596..d2a2ea1b65 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -81,3 +81,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index efd315eb71..cb49a67c41 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -80,3 +80,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml index af3edb56e4..9a776be427 100644 --- a/detections/endpoint/office_spawning_control.yml +++ b/detections/endpoint/office_spawning_control.yml @@ -85,3 +85,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index a61cab427c..4c2b15a2e0 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -69,3 +69,5 @@ tags: - Filesystem.dest risk_score: 72 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index fd1514f692..0a4ff79263 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -65,3 +65,5 @@ tags: - Processes.process_guid risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index 395f97aa89..f015fa1240 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -79,3 +79,5 @@ tags: - Processes.parent_process_id risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 0d2c0a5cfe..6110ef0b52 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 45 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml index 6bbeaa5f82..0ca4d0c6fd 100644 --- a/detections/endpoint/potentially_malicious_code_on_commandline.yml +++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml @@ -75,3 +75,5 @@ tags: - Processes.dest risk_score: 12 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 407a386845..5f8fcb73e6 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -55,3 +55,5 @@ tags: - Processes.process_path - Processes.parent_process_id security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index cc0796f0d5..41be205342 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -76,3 +76,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index 03204c0738..54aa65d39c 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -66,3 +66,5 @@ tags: - Processes.process_guid risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index debc480234..25799511ff 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -80,3 +80,5 @@ tags: - Filesystem.user risk_score: 63 security_domain: network + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index fa7813c41a..faec4079dd 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -71,3 +71,5 @@ tags: - Processes.process_name risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 1f31e2837d..335870e7f0 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -70,3 +70,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index faf4444a75..f6ebe63ee3 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -76,3 +76,5 @@ tags: - Processes.dest risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index 9d4d46991d..f05c0a88d0 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -54,3 +54,5 @@ tags: - Processes.process_path - Processes.parent_process_id security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index ffd507fbab..dae747c94c 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -79,3 +79,5 @@ tags: - Processes.dest risk_score: 45 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index b9a9021e9c..a1d2b48115 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -97,3 +97,5 @@ tags: - Registry.user risk_score: 76 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index deda9cfcc4..8535dac57e 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 8b71b94ee8..9a2eec50d2 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index a218e8cc62..17c83f11a9 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -61,3 +61,5 @@ tags: - Registry.user risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml index 4732042e6b..4a7362585c 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml @@ -67,3 +67,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml index b26ed0eae8..fff1f18412 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml @@ -68,3 +68,5 @@ tags: - Processes.parent_process_id risk_score: 45 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index 0cf0e762c5..2abcf01122 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -66,3 +66,5 @@ tags: - Processes.parent_process_id risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index ea0ab2981e..2f68f5492b 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -82,3 +82,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml index aa04af220f..d9ff14079a 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml @@ -66,3 +66,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remote_system_discovery_with_wmic.yml b/detections/endpoint/remote_system_discovery_with_wmic.yml index 04ca65e585..092c163d81 100644 --- a/detections/endpoint/remote_system_discovery_with_wmic.yml +++ b/detections/endpoint/remote_system_discovery_with_wmic.yml @@ -65,3 +65,5 @@ tags: - Processes.parent_process_id risk_score: 15 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index d0af4cc9ed..b88e03dead 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -76,3 +76,5 @@ tags: - Processes.process_id risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 87674bbcc3..ecbd7e4c63 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -73,3 +73,5 @@ tags: - Processes.user risk_score: 72 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index 1e798edac9..b48aa0033c 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -67,3 +67,5 @@ tags: - Processes.process_guid risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index c30db2d205..d24975ae03 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -71,3 +71,5 @@ tags: - Registry.registry_key_name risk_score: 60 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index f8acc400d0..e22be31c8a 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -91,3 +91,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index f299c462a3..845bd66115 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -69,3 +69,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 2027ca3881..632a790430 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 70 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index 3785dc0563..684c485717 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -73,3 +73,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index d69c4ab3dd..17516b0b39 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -62,3 +62,5 @@ tags: - Filesystem.file_path risk_score: 12 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index fe0205380e..daec04b402 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -78,3 +78,5 @@ tags: - Processes.user risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml index dc1b4e2e5c..1a20a684f4 100644 --- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -68,3 +68,5 @@ tags: - Processes.parent_process_id risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 96a6b392d3..12618ad7a7 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -71,3 +71,5 @@ tags: - Processes.dest risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 534990ea49..8860f35c80 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -65,3 +65,5 @@ tags: - Processes.parent_process_id risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index 0db0a14019..263758ac10 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -66,3 +66,5 @@ tags: - Processes.user risk_score: 48 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index ba117efbda..a7d455035f 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -73,3 +73,5 @@ tags: - Processes.user risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index c6fd3a72f5..053b428c8e 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -70,3 +70,5 @@ tags: - Processes.user risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index 277ac32080..003016f8c8 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -67,3 +67,5 @@ tags: - Registry.registry_value_name risk_score: 72 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index 08d251df74..ac87865b4c 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -65,3 +65,5 @@ tags: - Processes.dest risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index 9d355bbf5d..cf395a7332 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -71,3 +71,5 @@ tags: - Registry.dest risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml index 1d8219f0c5..8b57213736 100644 --- a/detections/endpoint/sdelete_application_execution.yml +++ b/detections/endpoint/sdelete_application_execution.yml @@ -73,3 +73,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index e404794b9e..9a46d7b579 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -68,3 +68,5 @@ tags: - Processes.process_guid risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index 2f456df538..916f0a8054 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -106,3 +106,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml index 4d3d83aa66..f1f7aa5fe7 100644 --- a/detections/endpoint/services_escalate_exe.yml +++ b/detections/endpoint/services_escalate_exe.yml @@ -75,3 +75,5 @@ tags: - Processes.parent_process_id risk_score: 76 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index 3761b132b9..7e4b21420b 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -79,3 +79,5 @@ tags: - Processes.parent_process_id risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 4faec0ffe0..b01036caed 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -73,3 +73,5 @@ tags: - Registry.dest risk_score: 48 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 6ac4dc6618..d8ac0829e0 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -68,3 +68,5 @@ tags: - Processes.user risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml index 27f644b7ad..c1a9885737 100644 --- a/detections/endpoint/silentcleanup_uac_bypass.yml +++ b/detections/endpoint/silentcleanup_uac_bypass.yml @@ -69,3 +69,5 @@ tags: - Registry.dest risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 48f1c3eba6..2d4277a1f6 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -66,3 +66,5 @@ tags: - Processes.process_name risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml index 214b13ac1c..fce44aa6e2 100644 --- a/detections/endpoint/slui_runas_elevated.yml +++ b/detections/endpoint/slui_runas_elevated.yml @@ -72,3 +72,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml index da332eedf0..0fa2eac2c0 100644 --- a/detections/endpoint/slui_spawning_a_process.yml +++ b/detections/endpoint/slui_spawning_a_process.yml @@ -70,3 +70,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index 75048de2bf..8f7e3d5acc 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 72 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index e9a8d089b5..f296a79eee 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -81,3 +81,5 @@ tags: - Processes.dest risk_score: 72 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml index 1e114c7ac9..7e2e1427db 100644 --- a/detections/endpoint/start_up_during_safe_mode_boot.yml +++ b/detections/endpoint/start_up_during_safe_mode_boot.yml @@ -66,3 +66,5 @@ tags: - Registry.dest risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 3e695150a0..790e3c976f 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -72,3 +72,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index 03ad024c6e..3e39f5d928 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -74,3 +74,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index b52fb89260..36e0a60730 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -73,3 +73,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml index 2c5ba047e9..8575a27f5d 100644 --- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -69,3 +69,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index be0e067ced..3b400ef260 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -75,3 +75,5 @@ tags: - Processes.parent_process_id risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index 54626c3ca3..a5d11e2305 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index b95320d0c2..fdb7e16f85 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml index 5446e67271..eb3153be52 100644 --- a/detections/endpoint/suspicious_msbuild_spawn.yml +++ b/detections/endpoint/suspicious_msbuild_spawn.yml @@ -81,3 +81,5 @@ tags: - Processes.parent_process_id risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index 76e082bafe..95b4ff024d 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -79,3 +79,5 @@ tags: - Processes.user risk_score: 40 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml index c90b293976..fb276a88f8 100644 --- a/detections/endpoint/suspicious_mshta_spawn.yml +++ b/detections/endpoint/suspicious_mshta_spawn.yml @@ -75,3 +75,5 @@ tags: - Processes.parent_process_id risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index cb986dae16..17c24c545f 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -74,3 +74,5 @@ tags: - Processes.user risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index d107f795d0..fd7c536250 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -78,3 +78,5 @@ tags: - Processes.parent_process_id risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 6884c73b1f..656aa2d5cb 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -88,3 +88,5 @@ tags: - Processes.parent_process_id risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index 25aadbe349..19e3560a01 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -88,3 +88,5 @@ tags: - Processes.parent_process_id risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml index 838bd7e76f..b0ddab468c 100644 --- a/detections/endpoint/suspicious_rundll32_plugininit.yml +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -69,3 +69,5 @@ tags: - Processes.parent_process_id risk_score: 42 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index 222729300e..c5e148e8c0 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -89,3 +89,5 @@ tags: - Processes.parent_process_id risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index decaa12b61..ee2bce6a7c 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -87,3 +87,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index f27fec7309..c663f88758 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -73,3 +73,5 @@ tags: - Processes.parent_process_id risk_score: 35 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index 6b9c3a6cd7..a804c6b96f 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -74,3 +74,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 1cf511bf39..ed1d109a7c 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -77,3 +77,5 @@ tags: - Processes.user risk_score: 28 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 72c25ff187..cba2897e4b 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -66,3 +66,5 @@ tags: - Processes.dest risk_score: 15 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 559d66164c..09b9bc2061 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -82,3 +82,5 @@ tags: - Processes.process_hash risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index b39e88bbc0..42cbd1ab82 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -74,3 +74,5 @@ tags: - Registry.registry_value_name risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml index f6537474ca..5cedb020fb 100644 --- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml +++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml @@ -71,3 +71,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index fc2c1b0fec..83fa05eb28 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -65,3 +65,5 @@ tags: - Processes.parent_process_id risk_score: 30 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index a22640a966..2327a5c01f 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -65,3 +65,5 @@ tags: - Processes.user risk_score: 45 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index a7a18b8cb4..d02e6ba8a7 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -70,3 +70,5 @@ tags: - Processes.dest risk_score: 45 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 0f6d7fd64c..a80dd8e2b8 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -72,3 +72,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index bc62aa7a0f..850cdb5cb6 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -80,3 +80,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 3b5d951b2f..6f5715c80a 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -64,3 +64,5 @@ tags: - Processes.user risk_score: 15 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index a11923aa97..371cf2a000 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -66,3 +66,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index 4563793a1a..a4dd560dc1 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -58,3 +58,5 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index f8c22e9a38..5f9705d849 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index 29a94ae877..65afeffe87 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -94,3 +94,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index 6e8dfa528a..f3a273dcc7 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -75,3 +75,5 @@ tags: - Registry.registry_value_data risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index 860b1cf24d..62174a5077 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -68,3 +68,5 @@ tags: - Registry.registry_path risk_score: 24 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index d30b7eb169..9cc4c5bafe 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -79,3 +79,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: access + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index dcedbd87eb..cb6ed79777 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -95,3 +95,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index 11b50baa38..3fb5c0f1e1 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -89,3 +89,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 1388db4a62..1179c42ae8 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -90,3 +90,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 804cb45e00..98a9002831 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -96,3 +96,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index 6e9e84ed39..b6958ef7af 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -92,3 +92,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml index 9e8d2015e3..15669cf7d5 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -83,3 +83,5 @@ tags: - Processes.parent_process_id risk_score: 60 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml index d94b7011e3..e442e6221c 100644 --- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -79,3 +79,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index ee54cbec60..e7ee7f4898 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -67,3 +67,5 @@ tags: - Processes.parent_process_id risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index bf0a3f099e..fe79ffa24e 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -65,3 +65,5 @@ tags: - Processes.parent_process_id risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml index 26f1b008ed..94331c9531 100644 --- a/detections/endpoint/winhlp32_spawning_a_process.yml +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index 79ab9fdff3..6edb916edb 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -79,3 +79,5 @@ tags: - Processes.parent_process_id risk_score: 70 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index 27bf1fe98d..46c8cb7d5a 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -81,3 +81,5 @@ tags: - Processes.parent_process_id risk_score: 70 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 083857a0c6..06690c892a 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index e97f6960b8..1460ebef98 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -78,3 +78,5 @@ tags: - Processes.parent_process_id risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 71b9b9c4e9..af04695147 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -78,3 +78,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index f7a2261b11..a459e91554 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -79,3 +79,5 @@ tags: - Processes.parent_process_id risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index 0a8560913c..b422b0def9 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -70,3 +70,5 @@ tags: - Registry.dest risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index 0828bdeb6f..0d1b86a632 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -77,3 +77,5 @@ tags: - Processes.user risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 85230e4b87..30c1805342 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -66,3 +66,5 @@ tags: - DNS.query risk_score: 56 security_domain: network + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/security_content_automation/detection_ta_mapping.csv b/security_content_automation/detection_ta_mapping.csv new file mode 100644 index 0000000000..4ce0deb0aa --- /dev/null +++ b/security_content_automation/detection_ta_mapping.csv @@ -0,0 +1,317 @@ +detection_name,cim_version,supported_tas,tas_with_cim_mapping +abnormally_high_number_of_cloud_security_group_api_calls,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_api_calls_from_previously_unseen_user_roles,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, splunk_ta_o365, Splunk_TA_box, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_compute_instance_created_in_previously_unused_region,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +cloud_provisioning_from_previously_unseen_country,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_compute_instance_created_with_previously_unseen_instance_type,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +cloud_compute_instance_created_by_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +cloud_provisioning_from_previously_unseen_region,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +abnormally_high_number_of_cloud_infrastructure_api_calls,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_compute_instance_created_with_previously_unseen_image,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +cloud_provisioning_from_previously_unseen_city,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_provisioning_from_previously_unseen_ip_address,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" +cloud_instance_modified_with_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" +linux_setuid_using_chmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +disabling_folderoptions_windows_feature,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +anomalous_usage_of_7zip,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +enable_rdp_in_other_port_number,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +excessive_number_of_taskhost_processes,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +xsl_script_execution_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +rundll32_control_rundll_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_schedule_task,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +serviceprincipalnames_discovery_with_setspn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +allow_operation_with_consent_admin,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_service_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +spoolsv_writing_a_dll,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +dsquery_domain_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_possible_access_or_modification_of_sshd_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +secretdumps_offline_ntds_dumping_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +attacker_tools_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +domain_account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +certutil_exe_certificate_extraction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_html_help_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +prevent_automatic_repair_mode_using_bcdedit,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_possible_access_to_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +get_domainpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +excessive_number_of_distinct_processes_created_in_windows_temp_folder,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +disable_registry_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +powershell_disable_security_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +svchost_exe_lolbas_execution_process_spawn,5.0.0,,Splunk_TA_microsoft_sysmon +disable_defender_spynet_reporting,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +certutil_download_with_verifyctl_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_nirsoft_advancedrun,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +cmd_echo_pipe___escalation,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_number_of_service_control_start_as_disabled,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_installutil_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_use_of_cmd_exe_to_launch_script_interpreters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +suspicious_icedid_rundll32_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_service_stop_attempt,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_copy_on_system32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +credential_dumping_via_symlink_to_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_searchprotocolhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_usage_of_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +permission_modification_using_takeown_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_at_application_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +reg_exe_manipulating_windows_services_registry_keys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +logon_script_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_possible_ssh_key_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +dump_lsass_via_procdump,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +getwmiobject_ds_computer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +sdclt_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +hide_user_account_from_sign_in_screen,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +deleting_of_net_users,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +revil_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_psexec_with_accepteula_flag,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_dcom_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +auto_admin_logon_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_doas_tool_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +modify_acl_permission_to_files_or_folder,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +getdomaingroup_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_amsi_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +wermgr_process_spawned_cmd_or_powershell_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_azurehound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_product_spawning_rundll32_with_no_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_exchange_web_shell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +time_provider_persistence_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +system_processes_run_from_unexpected_locations,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +scheduled_task_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +sc_exe_manipulating_windows_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +disable_defender_submit_samples_consent_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +ryuk_wake_on_lan_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +suspicious_msbuild_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_access_to_credential_files,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +suspicious_wevtutil_usage,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +excessive_usage_of_cacls_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +disabling_task_manager,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +office_document_spawned_child_process_to_download,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +processes_launching_netsh,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_possible_append_command_to_at_allow_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +single_letter_process_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +check_elevated_cmd_using_whoami,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +short_lived_windows_accounts,5.0.0,,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_cyberark" +possible_lateral_movement_powershell_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +schtasks_scheduling_job_on_remote_system,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +executables_or_script_creation_in_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +active_setup_registry_autostart,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +suspicious_rundll32_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +winword_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_regsvr32_register_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_install_kernel_module_using_modprobe_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +scheduled_task_creation_on_remote_endpoint_using_at,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_append_command_to_profile_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +nishang_powershelltcponeline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_mshta_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_sudoers_tmp_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_service_restarted,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +disabling_defender_services,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +getwmiobject_ds_group_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +firewall_allowed_program_enable,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +office_application_spawn_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_rundll32_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_gpupdate_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +extraction_of_registry_hives,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +powershell_start_bitstransfer,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_mshta_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_rundll32_application_control_bypass___setupapi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +recursive_delete_of_directory_in_batch_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +get_aduserresultantpasswordpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_dotnet_binary_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +net_profiler_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disable_etw_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +remote_process_instantiation_via_winrm_and_winrs,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_product_spawning_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +execution_of_file_with_multiple_extensions,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +remote_process_instantiation_via_winrm_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_process_file_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +any_powershell_downloadstring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_change_file_owner_to_root,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +process_creating_lnk_file_in_suspicious_location,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +wbadmin_delete_system_backups,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_pkexec_privilege_escalation,5.0.0,,Splunk_TA_microsoft_sysmon +disabling_controlpanel,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +attempt_to_stop_security_service,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excel_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +allow_inbound_traffic_by_firewall_rule_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +getdomaincomputer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +malicious_powershell_process___execution_policy_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_defender_enhanced_notification,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +fodhelper_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_regsvr32_application_control_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_curl_download_to_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remcos_client_registry_install_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_microsoft_workflow_compiler_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +bcdedit_failure_recovery_modification,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_service_file_created_in_systemd_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +slui_runas_elevated,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +batch_file_write_to_system32,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_dism_remove_defender,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_usage_of_taskkill,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +nltest_domain_trust_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +fsutil_zeroing_file,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +office_application_spawn_rundll32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +add_or_set_windows_defender_exclusion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +bitsadmin_download_file,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +print_processor_registry_autostart,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_path_interception_by_creation_of_program_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +cmdline_tool_not_executed_in_cmd_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_mshta_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_rundll32_startw,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +script_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +slui_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +scheduled_task_deleted_or_created_via_cmd,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +allow_network_discovery_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_file_created_in_kernel_driver_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disable_logs_using_wevtutil,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +revil_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_sharphound_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +wmiprsve_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_file_creation_in_profile_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +services_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +regsvr32_with_known_silent_switch_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_installutil_uninstall_option,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +deleting_shadow_copies,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +winhlp32_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disabling_firewall_with_netsh,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +elevated_group_discovery_with_net,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_setuid_using_setcap_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_preload_hijack_library_calls,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +windows_installutil_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +get_foresttrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_defender_exclusion_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_adfind_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disabling_cmd_application,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +msmpeng_application_dll_side_loading,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_insert_kernel_module_using_insmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +certutil_download_with_urlcache_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_msbuild_rename,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_mshta_child_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +set_default_powershell_execution_policy_to_unrestricted_or_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +uninstall_app_using_msiexec,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +execute_javascript_with_jscript_com_clsid,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +create_local_admin_accounts_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_uac_remote_restriction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_doas_conf_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +creation_of_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_file_creation_in_init_boot_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_disableantispyware_reg,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disable_defender_mpengine_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +getwmiobject_ds_user_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disable_windows_app_hotkeys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +dns_exfiltration_using_nslookup_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +clear_unallocated_sector_using_cipher_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_java_spawning_shell,5.0.0,,Splunk_TA_microsoft_sysmon +disable_defender_blockatfirstseen_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_wmi_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regsvcs_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +get_domaintrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_installutil_credential_theft,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +elevated_group_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +registry_keys_used_for_persistence,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_rundll32_application_control_bypass___syssetup,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +ping_sleep_batch_command,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_processes_used_for_system_network_configuration_discovery,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +clop_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_product_spawning_certutil,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +regsvr32_silent_and_install_param_dll_loading,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +msbuild_suspicious_spawned_by_script_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +hiding_files_and_directories_with_attrib_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +office_product_spawn_cmd_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +wsreset_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +certutil_with_decode_argument,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +allow_file_and_printing_sharing_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +system_information_discovery_detection,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +malicious_powershell_process_with_obfuscation_techniques,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_add_files_in_known_crontab_directories,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +eventvwr_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +icacls_deny_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +usn_journal_deletion,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +remote_system_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_html_help_using_infotech_storage_handlers,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_security_logs_using_minint_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +sdelete_application_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +curl_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +icacls_grant_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +winword_spawning_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +credential_dumping_via_copy_command_from_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regasm_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +enable_wdigest_uselogoncredential_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +control_loading_from_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_dllhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +spoolsv_spawning_rundll32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +conti_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +attempted_credential_dump_from_registry_via_reg_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +jscript_execution_using_cscript_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +bcdedit_command_back_to_normal_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +rundll32_shimcache_flush,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +screensaver_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +office_product_spawning_bitsadmin,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +change_default_file_association,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +wscript_or_cscript_suspicious_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +domain_controller_discovery_with_nltest,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_windows_behavior_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_curl_upload_to_remote_destination,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +unified_messaging_service_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_html_help_spawn_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regsvcs_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_service_started_or_enabled,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +java_class_file_download_by_java_user_agent,5.0.0,,"Splunk_TA_citrix-netscaler, Splunk_TA_nginx, Splunk_TA_microsoft-iis, Splunk_TA_websense-cg, Splunk_TA_squid, Splunk_TA_haproxy, Splunk_TA_mcafee-wg, Splunk_TA_cisco-wsa" +linux_at_allow_config_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disable_defender_antivirus_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_visudo_utility_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +schtasks_run_task_on_demand,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +schtasks_used_for_forcing_a_reboot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +windows_raccine_scheduled_task_deletion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +mshta_spawning_rundll32_or_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_attempt_to_disable_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +get_domainuser_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +suspicious_scheduled_task_from_public_directory,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +rundll32_with_no_command_line_arguments_with_network,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_service_creation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_nopasswd_entry_in_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +attempt_to_add_certificate_to_untrusted_store,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +process_kill_base_on_file_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +wsmprovhost_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +domain_account_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disabling_norun_windows_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +suspicious_rundll32_plugininit,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +file_with_samsam_extension,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +silentcleanup_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +ntdsutil_export_ntds,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disabling_systemrestore_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +vbscript_execution_using_wscript_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_spawning_control,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regasm_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +start_up_during_safe_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +office_product_spawning_mshta,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +change_to_safe_mode_with_network_config,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +potentially_malicious_code_on_commandline,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_rundll32_application_control_bypass___advpack,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +services_escalate_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +wget_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +remote_wmi_command_attempt,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +create_or_delete_windows_shares_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +unload_sysmon_filter_driver,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +resize_shadowstorage_volume,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +wmic_xsl_execution_via_url,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_reg_exe_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +etw_registry_disabled,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +process_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +samsam_test_file_write,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +impacket_lateral_movement_commandline_parameters,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +dump_lsass_via_comsvcs_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +creation_of_shadow_copy_with_wmic_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +overwriting_accessibility_binaries,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +add_defaultuser_and_password_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +bits_job_persistence,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_rundll32_dllregisterserver,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +any_powershell_downloadfile,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +mmc_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +w3wp_spawning_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_sharphound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_rclone_command_line_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_msbuild_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disabling_net_user_account,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +shim_database_installation_with_suspicious_parameters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +dns_query_length_with_high_standard_deviation,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_isc-bind, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox" diff --git a/security_content_automation/detection_ta_mapping.yml b/security_content_automation/detection_ta_mapping.yml new file mode 100644 index 0000000000..ffb96a2eb7 --- /dev/null +++ b/security_content_automation/detection_ta_mapping.yml @@ -0,0 +1,2150 @@ +abnormally_high_number_of_cloud_infrastructure_api_calls: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_citrix-netscaler + - Splunk_TA_nix + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_ossec + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_cisco-asa + - Splunk_TA_infoblox + - Splunk_TA_salesforce +abnormally_high_number_of_cloud_security_group_api_calls: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_citrix-netscaler + - Splunk_TA_nix + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_ossec + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_cisco-asa + - Splunk_TA_infoblox + - Splunk_TA_salesforce +account_discovery_with_net_app: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +active_setup_registry_autostart: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +add_defaultuser_and_password_in_registry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +add_or_set_windows_defender_exclusion: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +allow_file_and_printing_sharing_in_firewall: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +allow_inbound_traffic_by_firewall_rule_registry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +allow_network_discovery_in_firewall: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +allow_operation_with_consent_admin: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +anomalous_usage_of_7zip: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +any_powershell_downloadfile: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +any_powershell_downloadstring: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +attacker_tools_on_endpoint: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +attempt_to_add_certificate_to_untrusted_store: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +attempt_to_stop_security_service: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +attempted_credential_dump_from_registry_via_reg_exe: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +auto_admin_logon_registry_entry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +batch_file_write_to_system32: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +bcdedit_command_back_to_normal_mode_boot: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +bcdedit_failure_recovery_modification: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +bits_job_persistence: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +bitsadmin_download_file: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +certutil_download_with_urlcache_and_split_arguments: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +certutil_download_with_verifyctl_and_split_arguments: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +certutil_exe_certificate_extraction: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +certutil_with_decode_argument: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +change_default_file_association: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +change_to_safe_mode_with_network_config: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +check_elevated_cmd_using_whoami: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +clear_unallocated_sector_using_cipher_app: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +clop_common_exec_parameter: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +cloud_api_calls_from_previously_unseen_user_roles: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - splunk_ta_o365 + - Splunk_TA_box + - Splunk_TA_infoblox + - Splunk_TA_salesforce +cloud_compute_instance_created_by_previously_unseen_user: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_aws-kinesis-firehose +cloud_compute_instance_created_in_previously_unused_region: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_aws-kinesis-firehose +cloud_compute_instance_created_with_previously_unseen_image: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_aws-kinesis-firehose +cloud_compute_instance_created_with_previously_unseen_instance_type: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_aws-kinesis-firehose +cloud_instance_modified_with_previously_unseen_user: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_citrix-netscaler + - Splunk_TA_nix + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_ossec + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_salesforce +cloud_provisioning_from_previously_unseen_city: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_citrix-netscaler + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_cisco-asa + - Splunk_TA_infoblox + - Splunk_TA_salesforce +cloud_provisioning_from_previously_unseen_country: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_citrix-netscaler + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_cisco-asa + - Splunk_TA_infoblox + - Splunk_TA_salesforce +cloud_provisioning_from_previously_unseen_ip_address: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_citrix-netscaler + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_salesforce +cloud_provisioning_from_previously_unseen_region: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_aws-kinesis-firehose + tas_with_cim_mapping: + - Splunk_TA_citrix-netscaler + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_juniper + - splunk_ta_o365 + - Splunk_TA_cyberark + - Splunk_TA_box + - Splunk_TA_cisco-asa + - Splunk_TA_infoblox + - Splunk_TA_salesforce +cmd_echo_pipe___escalation: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +cmdline_tool_not_executed_in_cmd_shell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +conti_common_exec_parameter: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +control_loading_from_world_writable_directory: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +create_local_admin_accounts_using_net_exe: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +create_or_delete_windows_shares_using_net_exe: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +creation_of_shadow_copy: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +creation_of_shadow_copy_with_wmic_and_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +credential_dumping_via_copy_command_from_shadow_copy: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +credential_dumping_via_symlink_to_shadow_copy: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +curl_download_and_bash_execution: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +deleting_of_net_users: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +deleting_shadow_copies: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_azurehound_command_line_arguments: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_exchange_web_shell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +detect_html_help_spawn_child_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_html_help_url_in_command_line: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_html_help_using_infotech_storage_handlers: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_mshta_inline_hta_execution: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_mshta_url_in_command_line: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_path_interception_by_creation_of_program_exe: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_processes_used_for_system_network_configuration_discovery: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_psexec_with_accepteula_flag: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_rclone_command_line_usage: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_regasm_spawning_a_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +detect_regasm_with_no_command_line_arguments: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_regsvcs_spawning_a_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +detect_regsvcs_with_no_command_line_arguments: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_regsvr32_application_control_bypass: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_rundll32_application_control_bypass___advpack: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_rundll32_application_control_bypass___setupapi: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_rundll32_application_control_bypass___syssetup: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_rundll32_inline_hta_execution: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_sharphound_command_line_arguments: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +detect_sharphound_usage: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +detect_use_of_cmd_exe_to_launch_script_interpreters: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disable_amsi_through_registry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disable_defender_antivirus_registry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +disable_defender_blockatfirstseen_feature: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +disable_defender_enhanced_notification: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +disable_defender_mpengine_registry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +disable_defender_spynet_reporting: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +disable_defender_submit_samples_consent_feature: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +disable_etw_through_registry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disable_logs_using_wevtutil: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disable_registry_tool: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disable_schedule_task: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +disable_security_logs_using_minint_registry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +disable_uac_remote_restriction: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +disable_windows_app_hotkeys: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disable_windows_behavior_monitoring: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disabling_cmd_application: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disabling_controlpanel: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disabling_defender_services: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +disabling_firewall_with_netsh: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +disabling_folderoptions_windows_feature: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disabling_net_user_account: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +disabling_norun_windows_app: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disabling_systemrestore_in_registry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +disabling_task_manager: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +dns_exfiltration_using_nslookup_app: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +dns_query_length_with_high_standard_deviation: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_isc-bind + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_infoblox +domain_account_discovery_with_net_app: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +domain_account_discovery_with_wmic: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +domain_controller_discovery_with_nltest: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +dsquery_domain_discovery: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +dump_lsass_via_comsvcs_dll: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +dump_lsass_via_procdump: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +elevated_group_discovery_with_net: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +elevated_group_discovery_with_wmic: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +enable_rdp_in_other_port_number: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +enable_wdigest_uselogoncredential_registry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +etw_registry_disabled: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +eventvwr_uac_bypass: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +excel_spawning_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +excessive_attempt_to_disable_services: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +excessive_number_of_distinct_processes_created_in_windows_temp_folder: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_windows + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cyberark_epm +excessive_number_of_service_control_start_as_disabled: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +excessive_number_of_taskhost_processes: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_windows + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +excessive_service_stop_attempt: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +excessive_usage_of_cacls_app: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +excessive_usage_of_net_app: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +excessive_usage_of_taskkill: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +executables_or_script_creation_in_suspicious_path: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +execute_javascript_with_jscript_com_clsid: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +execution_of_file_with_multiple_extensions: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +extraction_of_registry_hives: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +file_with_samsam_extension: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - splunk_ta_o365 + - Splunk_TA_sophos + - Splunk_TA_cyberark + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +firewall_allowed_program_enable: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +fodhelper_uac_bypass: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +fsutil_zeroing_file: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +get_aduserresultantpasswordpolicy_with_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +get_domainpolicy_with_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +get_domaintrust_with_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +get_domainuser_with_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +get_foresttrust_with_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +getdomaincomputer_with_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +getdomaingroup_with_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +getwmiobject_ds_computer_with_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +getwmiobject_ds_group_with_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +getwmiobject_ds_user_with_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +hide_user_account_from_sign_in_screen: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +hiding_files_and_directories_with_attrib_exe: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +icacls_deny_command: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +icacls_grant_command: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +impacket_lateral_movement_commandline_parameters: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +java_class_file_download_by_java_user_agent: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_citrix-netscaler + - Splunk_TA_nginx + - Splunk_TA_microsoft-iis + - Splunk_TA_websense-cg + - Splunk_TA_squid + - Splunk_TA_haproxy + - Splunk_TA_mcafee-wg + - Splunk_TA_cisco-wsa +jscript_execution_using_cscript_app: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_add_files_in_known_crontab_directories: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_at_allow_config_file_creation: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_at_application_execution: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_change_file_owner_to_root: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_doas_conf_file_creation: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_doas_tool_execution: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_file_created_in_kernel_driver_directory: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_file_creation_in_init_boot_directory: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_file_creation_in_profile_directory: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_insert_kernel_module_using_insmod_utility: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_install_kernel_module_using_modprobe_utility: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_java_spawning_shell: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +linux_nopasswd_entry_in_sudoers_file: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_pkexec_privilege_escalation: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +linux_possible_access_or_modification_of_sshd_config_file: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_possible_access_to_credential_files: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_possible_access_to_sudoers_file: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_possible_append_command_to_at_allow_config_file: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_possible_append_command_to_profile_config_file: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_possible_ssh_key_file_creation: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_preload_hijack_library_calls: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_service_file_created_in_systemd_directory: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_service_restarted: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_service_started_or_enabled: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_setuid_using_chmod_utility: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_setuid_using_setcap_utility: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +linux_sudoers_tmp_file_creation: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_visudo_utility_execution: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +logon_script_event_trigger_execution: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +malicious_powershell_process___execution_policy_bypass: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +malicious_powershell_process_with_obfuscation_techniques: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +mmc_exe_lolbas_execution_process_spawn: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +modify_acl_permission_to_files_or_folder: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +msbuild_suspicious_spawned_by_script_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +mshta_spawning_rundll32_or_regsvr32_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +msmpeng_application_dll_side_loading: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +net_profiler_uac_bypass: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +nishang_powershelltcponeline: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +nltest_domain_trust_discovery: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +ntdsutil_export_ntds: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +office_application_spawn_regsvr32_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +office_application_spawn_rundll32_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +office_document_spawned_child_process_to_download: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +office_product_spawn_cmd_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +office_product_spawning_bitsadmin: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +office_product_spawning_certutil: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +office_product_spawning_mshta: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +office_product_spawning_rundll32_with_no_dll: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +office_product_spawning_wmic: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +office_spawning_control: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +overwriting_accessibility_binaries: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_ossec + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - splunk_ta_o365 + - Splunk_TA_sophos + - Splunk_TA_cyberark + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +permission_modification_using_takeown_app: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +ping_sleep_batch_command: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +possible_lateral_movement_powershell_spawn: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +potentially_malicious_code_on_commandline: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +powershell_disable_security_monitoring: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +powershell_start_bitstransfer: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +prevent_automatic_repair_mode_using_bcdedit: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +print_processor_registry_autostart: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +process_creating_lnk_file_in_suspicious_location: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +process_execution_via_wmi: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +process_kill_base_on_file_path: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +processes_launching_netsh: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +recursive_delete_of_directory_in_batch_cmd: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +reg_exe_manipulating_windows_services_registry_keys: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +registry_keys_used_for_persistence: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +regsvr32_silent_and_install_param_dll_loading: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +regsvr32_with_known_silent_switch_cmdline: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +remcos_client_registry_install_entry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_dcom_and_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_winrm_and_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_winrm_and_winrs: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_wmi: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_wmi_and_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +remote_system_discovery_with_wmic: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +remote_wmi_command_attempt: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +resize_shadowstorage_volume: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +revil_common_exec_parameter: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +revil_registry_entry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +rundll32_control_rundll_world_writable_directory: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +rundll32_shimcache_flush: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +rundll32_with_no_command_line_arguments_with_network: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +ryuk_wake_on_lan_command: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +samsam_test_file_write: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - splunk_ta_o365 + - Splunk_TA_sophos + - Splunk_TA_cyberark + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +sc_exe_manipulating_windows_services: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +scheduled_task_creation_on_remote_endpoint_using_at: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +scheduled_task_deleted_or_created_via_cmd: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +scheduled_task_initiation_on_remote_endpoint: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +schtasks_run_task_on_demand: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +schtasks_scheduling_job_on_remote_system: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +schtasks_used_for_forcing_a_reboot: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +screensaver_event_trigger_execution: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +script_execution_via_wmi: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cyberark_epm +sdclt_uac_bypass: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +sdelete_application_execution: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +secretdumps_offline_ntds_dumping_tool: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +serviceprincipalnames_discovery_with_setspn: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +services_escalate_exe: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +services_exe_lolbas_execution_process_spawn: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +set_default_powershell_execution_policy_to_unrestricted_or_bypass: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +shim_database_installation_with_suspicious_parameters: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +short_lived_windows_accounts: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_microsoft-cloudservices + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_cyberark +silentcleanup_uac_bypass: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +single_letter_process_on_endpoint: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cyberark_epm +slui_runas_elevated: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +slui_spawning_a_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +spoolsv_spawning_rundll32: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +spoolsv_writing_a_dll: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +start_up_during_safe_mode_boot: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +suspicious_copy_on_system32: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_dllhost_no_command_line_arguments: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_gpupdate_no_command_line_arguments: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_icedid_rundll32_cmdline: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_microsoft_workflow_compiler_usage: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_msbuild_path: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_msbuild_rename: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_msbuild_spawn: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_mshta_child_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +suspicious_mshta_spawn: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_process_file_path: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +suspicious_reg_exe_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +suspicious_regsvr32_register_suspicious_path: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_rundll32_dllregisterserver: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_rundll32_plugininit: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_rundll32_startw: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_rundll32_with_no_command_line_arguments: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_scheduled_task_from_public_directory: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +suspicious_searchprotocolhost_no_command_line_arguments: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +suspicious_wevtutil_usage: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +svchost_exe_lolbas_execution_process_spawn: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +system_information_discovery_detection: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cyberark_epm +system_processes_run_from_unexpected_locations: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +time_provider_persistence_registry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +unified_messaging_service_spawning_a_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +uninstall_app_using_msiexec: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +unload_sysmon_filter_driver: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +usn_journal_deletion: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +vbscript_execution_using_wscript_app: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +w3wp_spawning_shell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +wbadmin_delete_system_backups: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +wermgr_process_spawned_cmd_or_powershell_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +wget_download_and_bash_execution: + cim_version: 5.0.0 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +windows_adfind_exe: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +windows_curl_download_to_suspicious_path: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_curl_upload_to_remote_destination: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_defender_exclusion_registry_entry: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_disableantispyware_reg: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +windows_dism_remove_defender: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_dotnet_binary_in_non_standard_path: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_installutil_credential_theft: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_installutil_in_non_standard_path: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_installutil_uninstall_option: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_installutil_url_in_command_line: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_nirsoft_advancedrun: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_raccine_scheduled_task_deletion: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_service_creation_on_remote_endpoint: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_service_initiation_on_remote_endpoint: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +winhlp32_spawning_a_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +winword_spawning_cmd: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +winword_spawning_powershell: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +wmic_xsl_execution_via_url: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +wmiprsve_exe_lolbas_execution_process_spawn: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +wscript_or_cscript_suspicious_child_process: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +wsmprovhost_exe_lolbas_execution_process_spawn: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +wsreset_uac_bypass: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +xsl_script_execution_with_wmic: + cim_version: 5.0.0 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon diff --git a/security_content_automation/enrich_detections.py b/security_content_automation/enrich_detections.py new file mode 100644 index 0000000000..e6d2af4d59 --- /dev/null +++ b/security_content_automation/enrich_detections.py @@ -0,0 +1,328 @@ +import base64 +import csv +import io +import json +import logging +import os +import re +import shutil +import sys +import time +from pathlib import Path + +import git +import yaml +from github import Github + + +TIMESTAMP_FORMAT = '%(asctime)s %(levelname)s - %(message)s' + +def fetch_ta_cim_mapping_report(file_name): + try: + with open(file_name) as file_content: + cim_field_report = json.load(file_content) + return cim_field_report + except Exception as error: + error_message = f"Unexpected error occurred while reading file. {error}" + logging.error(error_message) + + +def load_file(file_path): + + try: + with open(file_path, "r", encoding="utf-8") as stream: + file = list(yaml.safe_load_all(stream))[0] + return file + except yaml.YAMLError as exc: + sys.exit("ERROR: reading {0}".format(file_path)) + + +def map_required_fields(cim_summary, datamodel, required_fields): + datasets_fields = {} + add_addon = False + flag = 0 + for item in required_fields: + # Only required field with valid format will be mapped + if re.match("^[A-Za-z0-9_.]*$", item): + if item == "_time" or item == "_times": + continue + else: + dataset_field = item.split(".") + length = len(dataset_field) + if length == 1: + dataset = datamodel[0] + field = dataset_field[0] + else: + dataset = dataset_field[length - 2] + field = dataset_field[length - 1] + if dataset not in datasets_fields: + datasets_fields[dataset] = [] + datasets_fields[dataset].append(field) + + for dataset in datasets_fields: + add_addon = False + mapping_set = datamodel[0] + ":" + dataset + for item in cim_summary: + if mapping_set in item: + for eventtype in cim_summary[item].values(): + for e_type in eventtype: + cim_fields = e_type.get("fields", []) + if set(datasets_fields[dataset]).issubset(set(cim_fields)): + add_addon = True + if add_addon == False: + return add_addon + + return add_addon + + +def is_valid_detection_file(filepath): + + detection_analytic_type = ["ttp", "anomaly"] + detection_with_valid_analytic_type = False + detection_with_valid_datamodel = False + detection_file_path = load_file(filepath) + + if detection_file_path.get("type", "").lower() in detection_analytic_type: + detection_with_valid_analytic_type = True + + if detection_file_path.get("datamodel", []): + detection_with_valid_datamodel = True + + return detection_with_valid_analytic_type & detection_with_valid_datamodel + + +def enrich_detection_file(file, ta_list, keyname): + detection_obj = load_file(file) + detection_obj["tags"][keyname] = ta_list + + with open(file, "w") as f: + yaml.dump(detection_obj, f, sort_keys=False, allow_unicode=True) + + +def main(): + + security_content_repo = "splunk/security_content" + security_content_branch = "develop" + + ta_cim_field_reports_repo = "splunk/ta-cim-field-reports" + ta_cim_field_reports_branch = "main" + + # Decodin GITHUB_ACCESS_TOKEN from base64 + git_token_base64_bytes = os.environ.get("GITHUB_ACCESS_TOKEN").encode('ascii') + git_token_bytes = base64.b64decode(git_token_base64_bytes) + github_token = git_token_bytes.decode('ascii') + + git_token = Github(github_token) + detection_types = ["cloud", "endpoint", "network"] + cim_report_path = ( + "ta_cim_mapping_reports/ta_cim_mapping/cim_mapping_reports/latest/" + ) + detection_ta_mapping = {} + + + try: + # clone security content repository + security_content_repo_obj = git.Repo.clone_from( + "https://" + + github_token + + ":x-oauth-basic@github.com/" + + security_content_repo, + "security_content", + branch=security_content_branch, + ) + message = "Successfully cloned security_content." + logging.info(message) + except Exception as error: + error_message = f"Unexpected error occurred while Cloning security_content, {error}" + logging.error(error_message) + + try: + # clone ta cim field reports repository + ta_cim_field_reports_obj = git.Repo.clone_from( + "https://" + + github_token + + ":x-oauth-basic@github.com/" + + ta_cim_field_reports_repo, + "ta_cim_mapping_reports", + branch=ta_cim_field_reports_branch, + ) + message = "Successfully cloned ta_cim_mapping_reports." + logging.info(message) + except Exception as error: + error_message = f"Unexpected error occurred while Cloning ta-cim-field-reports repo, {error}" + logging.error(error_message) + + + # iterate for every detection types + + + for detection_type in detection_types: + + for subdir, _, files in os.walk(f"security_content/tests/{detection_type}"): + + for file in files: + filepath = subdir + os.sep + file + tas_with_cim_mapping_list = [] + supported_tas_list = [] + detection_obj = load_file(filepath) + source_types = [] + for data in detection_obj.get("tests")[0].get("attack_data"): + source_types.append(data.get("sourcetype")) + + detection_file_name_path = ( + detection_obj.get("tests")[0] + .get("file") + .rsplit("/", 1)[1] + ) + detection_file_name = Path(detection_file_name_path).stem + filepath = "security_content/detections/" + detection_obj.get("tests")[ + 0 + ].get("file") + if not os.path.isfile(filepath): + continue + + if is_valid_detection_file(filepath): + for ta_cim_mapping_file in os.listdir(cim_report_path): + ta_cim_map = fetch_ta_cim_mapping_report( + cim_report_path + ta_cim_mapping_file + ) + + detection_obj = load_file(filepath) + required_fields = detection_obj.get("tags", {}).get( + "required_fields" + ) + datamodel = detection_obj.get("datamodel", []) + result = map_required_fields( + ta_cim_map["cimsummary"], datamodel, required_fields + ) + cim_version = ta_cim_map["cim_version"] + + if result: + tas_with_cim_mapping_list.append( + ta_cim_map.get("ta_name").get("name") + ) + ta_sourcetype = ta_cim_map["sourcetypes"] + for source_type in source_types: + + if ( + source_type in ta_sourcetype + and ta_cim_map.get("ta_name").get("name") + not in supported_tas_list + ): + supported_tas_list.append( + ta_cim_map.get("ta_name").get("name") + ) + detection_ta_mapping[detection_file_name] = {} + + if tas_with_cim_mapping_list: + keyname = "tas_with_cim_mapping" + detection_ta_mapping[detection_file_name][ + "cim_version" + ] = cim_version + detection_ta_mapping[detection_file_name][ + keyname + ] = tas_with_cim_mapping_list + + if supported_tas_list: + keyname = "supported_tas" + enrich_detection_file(filepath, supported_tas_list, keyname) + detection_ta_mapping[detection_file_name][ + keyname + ] = supported_tas_list + + logging.info(f"Enriched {detection_file_name} with supported TAs : {supported_tas_list}") + + security_content_repo_obj.index.add( + [filepath.strip("security_content/")] + ) + + # Generating detection_ta_mapping yml file + try: + with io.open( + r"./security_content/security_content_automation/detection_ta_mapping.yml", + "w", + encoding="utf8", + ) as outfile: + yaml.safe_dump( + detection_ta_mapping, outfile, default_flow_style=False, allow_unicode=True + ) + + security_content_repo_obj.index.add( + ["security_content_automation/detection_ta_mapping.yml"] + ) + message = "Created detection_ta_mapping.yml file" + logging.info(message) + + except Exception as error: + error_message = f"Unexpected error occurred while generating detection_ta_mapping.yml file, {error}" + logging.error(error_message) + + + # Generating detection_ta_mapping CSV report + try: + with open(r"./security_content/security_content_automation/detection_ta_mapping.csv", 'w+', newline='') as csv_file: + fieldnames = ['detection_name', 'cim_version', 'supported_tas', 'tas_with_cim_mapping'] + writer = csv.DictWriter(csv_file, fieldnames=fieldnames) + writer.writeheader() + for detection_name, detection_content in detection_ta_mapping.items(): + detection_content.update({ + 'tas_with_cim_mapping': ', '.join(detection_content["tas_with_cim_mapping"]) if detection_content.get( + 'tas_with_cim_mapping') else '', + 'supported_tas': ', '.join(detection_content["supported_tas"]) if detection_content.get( + 'supported_tas') else '', + 'detection_name': detection_name + }) + writer.writerow(detection_content) + security_content_repo_obj.index.add( + ["security_content_automation/detection_ta_mapping.csv"] + ) + message = "Created detection_ta_mapping.csv file" + logging.info(message) + + except Exception as error: + error_message = f"Unexpected error occurred while generating detection_ta_mapping CSV report, {error}" + logging.error(error_message) + + + + + + try: + security_content_repo_obj.index.commit( + "Updated detection files with recommended TA list." + ) + + epoch_time = str(int(time.time())) + branch_name = "security_content_automation_" + epoch_time + security_content_repo_obj.git.checkout("-b", branch_name) + security_content_repo_obj.git.push("--set-upstream", "origin", branch_name) + repo = git_token.get_repo("splunk/security_content") + + pr = repo.create_pull( + title="Enrich Detection PR " + branch_name, + body="Enriched the detections with supported TAs", + head=branch_name, + base="develop", + ) + message = "Created pull request" + logging.info(message) + except Exception as error: + error_message = f"Unexpected error occurred while creating pull request, {error}" + logging.error(error_message) + + + try: + shutil.rmtree("./security_content") + shutil.rmtree("./ta_cim_mapping_reports") + message = "Cleaned up the environment" + logging.info(message) + except OSError as e: + error_message = f"Unexpected error occurred while deleting files, {error}" + logging.error(error_message) + + +if __name__ == "__main__": + log_level=logging.INFO + handlers = [logging.StreamHandler()] + logging.basicConfig(level=log_level, format=TIMESTAMP_FORMAT, handlers=handlers) + main() diff --git a/security_content_automation/requirements.txt b/security_content_automation/requirements.txt new file mode 100644 index 0000000000..3cfcdd61da --- /dev/null +++ b/security_content_automation/requirements.txt @@ -0,0 +1,3 @@ +GitPython==3.1.24 +PyYAML==6.0 +PyGithub==1.55 \ No newline at end of file