From 8a8f5949e5bf050733fe0673d3223fd435f648c1 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Sep 2023 14:35:11 -0700 Subject: [PATCH] updating type --- .../cloud/azure_ad_user_enabled_and_password_reset.yml | 10 +++++----- ...ct_certify_with_powershell_script_block_logging.yml | 2 +- ...s_steal_authentication_certificates___esc1_auth.yml | 4 ++-- ...ows_suspect_process_with_authentication_traffic.yml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml index 0ea877c255..2399b3bfef 100644 --- a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -14,8 +14,8 @@ search: ' `azuread` (operationName="Enable account" OR operationName="Reset pass OR operationName="Update user") | transaction properties.targetResources{}.userPrincipalName startsWith=(operationName="Enable account") endsWith=(operationName="Reset password (by admin)") maxspan=2m | rename properties.* as * | rename targetResources{}.userPrincipalName - as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy - | stats values(operationName) values(initiatedBy) as initiatedBy by _time, userPrincipalName, + as user | rename initiatedBy.user.userPrincipalName as initiatedBy + | stats values(operationName) values(initiatedBy) as initiatedBy by _time, user, result | `azure_ad_user_enabled_and_password_reset_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). @@ -36,12 +36,12 @@ tags: mitre_attack_id: - T1098 observable: - - name: userPrincipalName - type: User Name + - name: user + type: User role: - Victim - name: initiatedBy - type: User Name + type: User role: - Attacker product: diff --git a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml index 82999f056a..a49a723f23 100644 --- a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml @@ -39,7 +39,7 @@ tags: role: - Victim - name: user - type: User Name + type: User role: - Victim - name: command diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml index 9197b58229..1252e1fa58 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml @@ -57,11 +57,11 @@ tags: role: - Victim - name: src_user - type: User Name + type: User role: - Victim - name: user - type: User Name + type: User role: - Victim - name: ssl_hash diff --git a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml index 8fb98fd699..c63a41940f 100644 --- a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml +++ b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml @@ -55,7 +55,7 @@ tags: role: - Victim - name: user - type: User Name + type: User role: - Victim - name: process_name