diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index d1a5d0ccd3..f12af4889a 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -48,6 +48,7 @@ tags: message: The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. mitre_attack_id: + - T1218 - T1218.009 nist: - PR.PT diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index 9fbe7b7eef..d9c60a5d52 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -56,6 +56,7 @@ tags: to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. mitre_attack_id: + - T1218 - T1218.010 nist: - DE.CM diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 3b871de923..686669851d 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -42,6 +42,7 @@ tags: $parent_process_name$ on $dest$ by $user$. mitre_attack_id: - T1560.001 + - T1560 observable: - name: user type: User diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 1376383912..f3bed31e95 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -49,6 +49,7 @@ tags: message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. mitre_attack_id: + - T1569 - T1569.002 observable: - name: user diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index d8e9ec6d8a..6cdad6b951 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -45,6 +45,7 @@ tags: $parent_process_name$ on $dest$ by $user$. mitre_attack_id: - T1560.001 + - T1560 observable: - name: user type: User diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index c9a45dec66..95e6971170 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -54,6 +54,7 @@ tags: and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. mitre_attack_id: + - T1218 - T1218.011 nist: - PR.PT diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index 2efa7beab7..a50999441c 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -52,6 +52,7 @@ tags: and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. mitre_attack_id: + - T1218 - T1218.011 nist: - PR.PT diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 3b6861a30d..d7be020574 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -54,6 +54,7 @@ tags: by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. mitre_attack_id: + - T1218 - T1218.011 nist: - PR.PT diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 6dc7254f55..b25022b50a 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -52,6 +52,7 @@ tags: - Exploitation message: Suspicious rundll32.exe inline HTA execution on $dest$ mitre_attack_id: + - T1218 - T1218.005 nist: - PR.PT diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index 854e1b806e..ae13c1ce47 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -45,10 +45,12 @@ tags: message: Possible SharpHound command-Line arguments identified on $dest$ mitre_attack_id: - T1087.002 - - T1087.001 - - T1482 - - T1069.002 - T1069.001 + - T1482 + - T1087.001 + - T1087 + - T1069.002 + - T1069 observable: - name: dest type: Endpoint diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index 04a57dc1ec..f8b790df6d 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -55,10 +55,12 @@ tags: message: Potential SharpHound file modifications identified on $dest$ mitre_attack_id: - T1087.002 - - T1087.001 - - T1482 - - T1069.002 - T1069.001 + - T1482 + - T1087.001 + - T1087 + - T1069.002 + - T1069 observable: - name: dest type: Endpoint diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index e69fcf6439..01e9367191 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -50,10 +50,12 @@ tags: message: Potential SharpHound binary identified on $dest$ mitre_attack_id: - T1087.002 - - T1087.001 - - T1482 - - T1069.002 - T1069.001 + - T1482 + - T1087.001 + - T1087 + - T1069.002 + - T1069 observable: - name: dest type: Endpoint diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index c5730624be..134409ee6a 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -43,6 +43,7 @@ tags: - Exploitation message: cmd.exe launching script interpreters on $dest$ mitre_attack_id: + - T1059 - T1059.003 nist: - PR.PT diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml index be44a1befb..158adc2573 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml @@ -57,6 +57,7 @@ tags: message: Possible malicious WMI Subscription created on $dest$ mitre_attack_id: - T1546.003 + - T1546 observable: - name: dest type: Endpoint diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 893026ae11..b3234563e7 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -35,6 +35,7 @@ tags: - Exploitation mitre_attack_id: - T1562.001 + - T1562 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 8e62da2998..15fc3b41a4 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -33,6 +33,7 @@ tags: - Exploitation mitre_attack_id: - T1562.001 + - T1562 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 737789fa40..e4f7d51475 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -38,6 +38,7 @@ tags: - Exploitation message: WevtUtil.exe used to disable Event Logging on $dest mitre_attack_id: + - T1070 - T1070.001 observable: - name: dest diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index b86174c023..c4a9d34f67 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -41,6 +41,7 @@ tags: message: Disabled Registry Tools on $dest$ mitre_attack_id: - T1562.001 + - T1562 observable: - name: dest type: Endpoint diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 8db415439d..7fc1e7e9ce 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -44,6 +44,8 @@ tags: mitre_attack_id: - T1564.001 - T1562.001 + - T1564 + - T1562 observable: - name: dest type: Endpoint diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 80d564165f..e52ca1e423 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -37,6 +37,7 @@ tags: - Exploitation mitre_attack_id: - T1548.002 + - T1548 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 6fee3152df..9f5f3fcfa4 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -43,6 +43,7 @@ tags: message: Disabled 'Windows App Hotkeys' on $dest$ mitre_attack_id: - T1562.001 + - T1562 observable: - name: dest type: Endpoint diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index bec73336b9..70d9ef034a 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -49,6 +49,7 @@ tags: message: Windows Defender real time behavior monitoring disabled on $dest mitre_attack_id: - T1562.001 + - T1562 observable: - name: dest type: Endpoint diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 4d95ec618e..530c2b238b 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -41,6 +41,7 @@ tags: message: The Windows Smartscreen was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 + - T1562 observable: - name: user type: User diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 2e71a905be..da42de93a5 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -40,6 +40,7 @@ tags: message: The Windows command prompt was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 + - T1562 observable: - name: user type: User diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index c885277219..af3b83aa32 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -39,6 +39,7 @@ tags: message: The Windows Control Panel was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 + - T1562 observable: - name: user type: User diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index 885e7cc657..14bd3ece53 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -42,6 +42,7 @@ tags: message: The Windows Firewall was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 + - T1562 observable: - name: user type: User diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index c248d73630..b7c827178f 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -41,6 +41,7 @@ tags: message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 + - T1562 observable: - name: user type: User diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index aa5c91dd54..e64e16287e 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -43,6 +43,7 @@ tags: start menu on $dest$ by $user$. mitre_attack_id: - T1562.001 + - T1562 observable: - name: user type: User diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 7880312f6d..18d6e60eed 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -43,6 +43,7 @@ tags: Account Control (UAC) were modified on $dest$ by $user$. mitre_attack_id: - T1548.002 + - T1548 nist: - PR.PT - DE.CM diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 192f7c9f14..1447e5c71e 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -43,6 +43,7 @@ tags: $user$. mitre_attack_id: - T1562.001 + - T1562 observable: - name: user type: User diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index aa7fe700ee..7e09a87f91 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -41,6 +41,7 @@ tags: message: The Windows Task Manager was disabled on $dest$ by $user$. mitre_attack_id: - T1562.001 + - T1562 observable: - name: user type: User diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml index 4703bc326c..a529264fd2 100644 --- a/detections/endpoint/domain_account_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -40,6 +40,7 @@ tags: message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: - T1087.002 + - T1087 observable: - name: user type: User diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml index 53071f5dbc..a7d03f7b80 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -40,6 +40,7 @@ tags: message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: - T1087.002 + - T1087 observable: - name: user type: User diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index 8fbac42c86..040d016318 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -41,6 +41,7 @@ tags: message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: - T1087.002 + - T1087 observable: - name: user type: User diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index 48e8ee1be7..29010d86d3 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -37,6 +37,7 @@ tags: - Reconnaissance message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml index 03fc2440bf..d0a5bb3640 100644 --- a/detections/endpoint/domain_group_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml @@ -38,6 +38,7 @@ tags: - Reconnaissance message: Domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index f485b33d70..f591073b41 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -38,6 +38,7 @@ tags: - Reconnaissance message: Domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml index ddd98a6d2a..80069157d4 100644 --- a/detections/endpoint/domain_group_discovery_with_wmic.yml +++ b/detections/endpoint/domain_group_discovery_with_wmic.yml @@ -39,6 +39,7 @@ tags: - Reconnaissance message: Domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index e2636e402e..0906ac0fba 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -35,6 +35,7 @@ tags: - Exploitation message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ mitre_attack_id: + - T1204 - T1204.002 observable: - name: Computer diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index cc1297820a..ee1428e64c 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -45,6 +45,7 @@ tags: accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. mitre_attack_id: - T1003.001 + - T1003 nist: - DE.CM observable: diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 1de3f88d35..c8b3d080d8 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -54,6 +54,7 @@ tags: attempting to dump lsass.exe on endpoint $dest$ by user $user$. mitre_attack_id: - T1003.001 + - T1003 nist: - DE.CM observable: diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml index 14656d4d5a..c69c5ffe53 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/endpoint/elevated_group_discovery_with_net.yml @@ -45,6 +45,7 @@ tags: - Reconnaissance message: Elevated domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml index 2a43fd5d03..a23c18ea20 100644 --- a/detections/endpoint/elevated_group_discovery_with_powerview.yml +++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml @@ -43,6 +43,7 @@ tags: - Reconnaissance message: Elevated group discovery using PowerView on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml index 5ff7c11059..bab8fab7ba 100644 --- a/detections/endpoint/elevated_group_discovery_with_wmic.yml +++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml @@ -43,6 +43,7 @@ tags: - Reconnaissance message: Elevated domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: + - T1069 - T1069.002 observable: - name: dest diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index f194488b2d..d8d8d11524 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -42,6 +42,7 @@ tags: cracking or observability. mitre_attack_id: - T1003.002 + - T1003 observable: - name: user type: User diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index c129367c35..48fefa846e 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -15,9 +15,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `etw_registry_disabled_filter`' -how_to_implement: To successfully implement this search, you must be ingesting - data that records registry activity from your hosts to populate the endpoint data - model in the registry node. This is typically populated via endpoint detection-and-response +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. @@ -35,6 +35,7 @@ tags: mitre_attack_id: - T1562.006 - T1127 + - T1562 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index e19f3460b2..c9fc2acc9d 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -45,6 +45,7 @@ tags: by $user$. mitre_attack_id: - T1548.002 + - T1548 observable: - name: user type: User diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index d18a9c48fa..b853bffe4d 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -46,6 +46,7 @@ tags: on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. mitre_attack_id: - T1003.002 + - T1003 observable: - name: user type: User diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index 559e3a2dd7..e808a71e12 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -48,6 +48,7 @@ tags: on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. mitre_attack_id: - T1003.002 + - T1003 observable: - name: user type: User diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 208cb6f66b..13477b9ca3 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -48,6 +48,7 @@ tags: to disable services. mitre_attack_id: - T1562.001 + - T1562 observable: - name: dest type: Hostname diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index b744ba7619..62ea23123b 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -33,6 +33,7 @@ tags: kill_chain_phases: - Exploitation mitre_attack_id: + - T1569 - T1569.002 product: - Splunk Enterprise diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index a9bb1c522d..116d72a6d9 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -39,6 +39,7 @@ tags: 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. mitre_attack_id: - T1562.001 + - T1562 observable: - name: dest type: Endpoint diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 132ee7ef02..2ca3561bc3 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -39,6 +39,7 @@ tags: where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$ mitre_attack_id: + - T1059 - T1059.005 observable: - name: user diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 1f2d894cf6..fdecc0cb1d 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -42,6 +42,7 @@ tags: message: process $process$ have double extensions in the file name is executed on $dest$ by $user$ mitre_attack_id: + - T1036 - T1036.003 nist: - DE.CM diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml index bec548212b..474f424a7e 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/endpoint/extraction_of_registry_hives.yml @@ -44,6 +44,7 @@ tags: credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ mitre_attack_id: - T1003.002 + - T1003 observable: - name: user type: User diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index 27a56f9b48..6586eae065 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -55,6 +55,7 @@ tags: mitre_attack_id: - T1112 - T1548.002 + - T1548 observable: - name: user type: User diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index b00b8fede5..d7d92a915a 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -42,6 +42,7 @@ tags: message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: - T1087.002 + - T1087 observable: - name: user type: User diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index 86b2592af0..8f3f227eae 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -39,6 +39,7 @@ tags: message: powershell process having commandline $Message$ for user enumeration mitre_attack_id: - T1087.002 + - T1087 observable: - name: ComputerName type: Hostname diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index 1dd28005b7..6ec2b802dc 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -41,6 +41,7 @@ tags: message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: - T1087.002 + - T1087 observable: - name: user type: User diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index 658af116c9..aec6b0b367 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -36,6 +36,7 @@ tags: message: powershell process having commandline $Message$ for user enumeration mitre_attack_id: - T1087.002 + - T1087 observable: - name: ComputerName type: Hostname diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml index 4505077cb7..b162b59416 100644 --- a/detections/endpoint/get_wmiobject_group_discovery.yml +++ b/detections/endpoint/get_wmiobject_group_discovery.yml @@ -43,6 +43,7 @@ tags: - Reconnaissance message: System group discovery on $dest$ by $user$. mitre_attack_id: + - T1069 - T1069.001 observable: - name: dest