From ad42cb18cecb21586e2bacbbffead86502d2690c Mon Sep 17 00:00:00 2001 From: pyth0n1c Date: Wed, 6 Nov 2024 16:46:09 -0800 Subject: [PATCH] fix baselines and investigations --- ...ohibited_processes_to_enterprise_security.yml | 16 +--------------- .../baseline_of_api_calls_per_user_arn.yml | 15 +-------------- ...ive_aws_instances_launched_by_user___mltk.yml | 15 +-------------- ...e_aws_instances_terminated_by_user___mltk.yml | 15 +-------------- ...een_api_call_per_user_roles_in_cloudtrail.yml | 15 +-------------- ...ly_seen_aws_provisioning_activity_sources.yml | 15 +-------------- .../deprecated/previously_seen_ec2_amis.yml | 15 +-------------- .../previously_seen_ec2_instance_types.yml | 15 +-------------- .../previously_seen_ec2_launches_by_user.yml | 13 ------------- .../previously_seen_users_in_cloudtrail.yml | 15 +-------------- ...pdate_previously_seen_users_in_cloudtrail.yml | 15 +-------------- baselines/dnstwist_domain_names.yml | 16 +--------------- .../investigate_network_traffic_from_src_ip.yml | 2 -- 13 files changed, 11 insertions(+), 171 deletions(-) diff --git a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml b/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml index 6aa827b83b..045d81112c 100644 --- a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml +++ b/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml @@ -20,7 +20,6 @@ tags: - Emotet Malware DHS Report TA18-201A - Monitor for Unauthorized Software - SamSam Ransomware - asset_type: Endpoint detections: - Prohibited Software On Endpoint product: @@ -29,17 +28,4 @@ tags: - Splunk Cloud required_fields: - _time - security_domain: endpoint - kill_chain_phases: - - Exploitation - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown + security_domain: endpoint \ No newline at end of file diff --git a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml b/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml index 02874c9c4a..ba5dd7e652 100644 --- a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml +++ b/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml @@ -32,17 +32,4 @@ tags: - _time - eventType - userIdentity.arn - security_domain: network - kill_chain_phases: - - Exploitation - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown + security_domain: network \ No newline at end of file diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml index d1dcf15f47..57eff79029 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml +++ b/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml @@ -44,17 +44,4 @@ tags: - eventName - errorCode - src_user - security_domain: network - kill_chain_phases: - - Exploitation - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown + security_domain: network \ No newline at end of file diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml index 1643566a67..ab4f8d7034 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml +++ b/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml @@ -44,17 +44,4 @@ tags: - eventName - errorCode - src_user - security_domain: network - kill_chain_phases: - - Exploitation - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown + security_domain: network \ No newline at end of file diff --git a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml b/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml index cfb61398a8..f8b4361464 100644 --- a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml +++ b/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml @@ -35,17 +35,4 @@ tags: - userIdentity.type - userName - eventName - security_domain: network - kill_chain_phases: - - Exploitation - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown + security_domain: network \ No newline at end of file diff --git a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml b/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml index 9c977eb85c..7f31d39d82 100644 --- a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml +++ b/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml @@ -33,17 +33,4 @@ tags: - _time - eventName - sourceIPAddress - security_domain: network - kill_chain_phases: - - Exploitation - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown + security_domain: network \ No newline at end of file diff --git a/baselines/deprecated/previously_seen_ec2_amis.yml b/baselines/deprecated/previously_seen_ec2_amis.yml index 7c07f5b16c..adc1b0bfe4 100644 --- a/baselines/deprecated/previously_seen_ec2_amis.yml +++ b/baselines/deprecated/previously_seen_ec2_amis.yml @@ -29,17 +29,4 @@ tags: - eventName - errorCode - requestParameters.instancesSet.items{}.imageId - security_domain: network - kill_chain_phases: - - Exploitation - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown + security_domain: network \ No newline at end of file diff --git a/baselines/deprecated/previously_seen_ec2_instance_types.yml b/baselines/deprecated/previously_seen_ec2_instance_types.yml index caa4874b07..ad702b1b8d 100644 --- a/baselines/deprecated/previously_seen_ec2_instance_types.yml +++ b/baselines/deprecated/previously_seen_ec2_instance_types.yml @@ -29,17 +29,4 @@ tags: - eventName - errorCode - requestParameters.instanceType - security_domain: network - kill_chain_phases: - - Exploitation - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown + security_domain: network \ No newline at end of file diff --git a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml b/baselines/deprecated/previously_seen_ec2_launches_by_user.yml index b9055ec06d..03d3950cce 100644 --- a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml +++ b/baselines/deprecated/previously_seen_ec2_launches_by_user.yml @@ -31,16 +31,3 @@ tags: - errorCode - requestParameters.instanceType security_domain: network - kill_chain_phases: - - Exploitation - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown diff --git a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml b/baselines/deprecated/previously_seen_users_in_cloudtrail.yml index c10e6be865..3b6c389848 100644 --- a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml +++ b/baselines/deprecated/previously_seen_users_in_cloudtrail.yml @@ -37,17 +37,4 @@ tags: - eventName - userIdentity.arn - src - security_domain: network - kill_chain_phases: - - Exploitation - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown + security_domain: network \ No newline at end of file diff --git a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml b/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml index f7672203b6..703754631e 100644 --- a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml +++ b/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml @@ -39,17 +39,4 @@ tags: - eventName - userIdentity.arn - src - security_domain: network - kill_chain_phases: - - Exploitation - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: field - type: Unknown - role: - - Unknown + security_domain: network \ No newline at end of file diff --git a/baselines/dnstwist_domain_names.yml b/baselines/dnstwist_domain_names.yml index 56d143e729..c213db75ac 100644 --- a/baselines/dnstwist_domain_names.yml +++ b/baselines/dnstwist_domain_names.yml @@ -19,7 +19,6 @@ tags: analytic_story: - Brand Monitoring - Suspicious Emails - asset_type: Endpoint detections: - Monitor Email For Brand Abuse - Monitor DNS For Brand Abuse @@ -28,19 +27,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - kill_chain_phases: - - Exploitation required_fields: - _time - security_domain: network - confidence: 50 - impact: 50 - risk_score: 25 - context: - - Unknown - message: tbd - observable: - - name: dest - type: Other - role: - - Other + security_domain: network \ No newline at end of file diff --git a/investigations/investigate_network_traffic_from_src_ip.yml b/investigations/investigate_network_traffic_from_src_ip.yml index 67424cbe4b..2a81e04487 100644 --- a/investigations/investigate_network_traffic_from_src_ip.yml +++ b/investigations/investigate_network_traffic_from_src_ip.yml @@ -16,8 +16,6 @@ references: [] tags: analytic_story: - ColdRoot MacOS RAT - cve: - - CVE-2018-11409 product: - Splunk Phantom required_fields: