Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2022-02-14 12:59:05 -08:00
parent d96849c449 52ab302315
commit af6dabf0e5
754 changed files with 1507 additions and 9 deletions
@@ -345,11 +345,14 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag
        additional_detection_lookups = parse_and_add_lookups(detection_yaml['search'], lookups)
        if len(additional_detection_lookups) > 0:
            for lookup in additional_detection_lookups:
+                # skip duplicate lookups
+                if lookup in detection_lookups:
+                    continue
                detection_lookups.append(lookup)
            detection_yaml['lookups'] = detection_lookups
        detection_yaml['lookups'] = detection_lookups
        
-          # sort macros and lookups
+        # sort macros and lookups
        sorted_macros = sorted(detection_yaml['macros'], key=lambda i: i['name'])
        detection_yaml['macros'] = sorted_macros
        sorted_lookups = sorted(detection_yaml['lookups'], key=lambda i: i['name'])
@@ -119,6 +119,8 @@ The SPL above uses the following Lookups:
 | {{(detection.tags.impact * detection.tags.confidence)/100}} | {{ detection.tags.impact }} | {{ detection.tags.confidence }} | {{detection.tags.message}} |
 {% endif %}

+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+
 {% if detection.cve %}
 #### CVE

@@ -61,8 +61,8 @@ sidebar:
 | [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
@@ -357,8 +357,8 @@ sidebar:
 | [Gsuite Suspicious Shared File Name](/cloud/gsuite_suspicious_shared_file_name/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly |
 | [Gsuite suspicious calendar invite](/cloud/gsuite_suspicious_calendar_invite/) | [Phishing](/tags/#phishing) | Hunting |
 | [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP |
 | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly |
 | [High Frequency Copy Of Files In Network Share](/endpoint/high_frequency_copy_of_files_in_network_share/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | Anomaly |
@@ -73,6 +73,8 @@ Legitimate router connections may appear as new connections



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -76,6 +76,8 @@ This search might be prone to high false positives. Please consider this when co



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -75,6 +75,8 @@ None identified



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -79,6 +79,8 @@ None at this time



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -82,6 +82,8 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -82,6 +82,8 @@ It&#39;s possible for legitimate HTTP requests to be made to URLs containing the



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -76,6 +76,8 @@ No known false positives for this detection.



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -76,6 +76,8 @@ None at this time



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -70,6 +70,8 @@ Very few legitimate Content-Type fields will have a length greater than 100 char



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -82,6 +82,8 @@ None at this time



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -60,7 +60,6 @@ Note that `detect_spike_in_blocked_outbound_traffic_from_your_aws_filter` is a e
 #### Lookups
 The SPL above uses the following Lookups:

-* [baseline_blocked_outbound_connections](https://github.com/splunk/security_content/blob/develop/lookups/baseline_blocked_outbound_connections.yml) with [data](https://github.com/splunk/security_content/blob/develop/lookups/baseline_blocked_outbound_connections.csv)
 * [baseline_blocked_outbound_connections](https://github.com/splunk/security_content/blob/develop/lookups/baseline_blocked_outbound_connections.yml) with [data](https://github.com/splunk/security_content/blob/develop/lookups/baseline_blocked_outbound_connections.csv)

 #### Required field
@@ -89,6 +88,8 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -85,6 +85,8 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -87,6 +87,8 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -87,6 +87,8 @@ After a new image is created, the first systems created with that image will cau
 | 36.0 | 60 | 60 | User $user$ is creating an instance $dest$ with an image that has not been previously seen. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -83,6 +83,8 @@ Although unlikely, administrators may use event subscriptions for legitimate pur



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -81,6 +81,8 @@ Some software may create WMI temporary event subscriptions for various purposes.



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -73,7 +73,6 @@ Note that `detect_spike_in_s3_bucket_deletion_filter` is a empty macro by defaul
 #### Lookups
 The SPL above uses the following Lookups:

-* [s3_deletion_baseline](https://github.com/splunk/security_content/blob/develop/lookups/s3_deletion_baseline.yml) with [data](https://github.com/splunk/security_content/blob/develop/lookups/s3_deletion_baseline.csv)
 * [s3_deletion_baseline](https://github.com/splunk/security_content/blob/develop/lookups/s3_deletion_baseline.yml) with [data](https://github.com/splunk/security_content/blob/develop/lookups/s3_deletion_baseline.csv)

 #### Required field
@@ -98,6 +97,8 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -89,6 +89,8 @@ Administrators may use this legitimately to gather info from remote systems. Fil
 | 36.0 | 60 | 60 | A wmic.exe process $process$ contain node commandline $process$ in host $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -89,6 +89,8 @@ None identified
 | 45.0 | 50 | 90 | Possible USN journal deletion on $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -77,6 +77,8 @@ There are no known false positives.



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -78,6 +78,8 @@ Because these extensions are not typically used in normal operations, you should
 | 90.0 | 100 | 90 | File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -85,6 +85,8 @@ No false positives have been identified.
 | 12.0 | 60 | 20 | A samsam ransomware test file creation in $file_path$ in host $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -72,6 +72,8 @@ There might be some false positives as keyboard event taps are used by processes



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -82,6 +82,8 @@ Some of these processes may be used legitimately on web servers during maintenan



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -80,6 +80,8 @@ Some legitimate applications use long command lines for installs or updates. You



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -93,6 +93,8 @@ The activity may be legitimate. Other tools can access lsass for legitimate reas
 | 80.0 | 80 | 100 | The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -93,6 +93,8 @@ Other tools can import the same DLLs. These tools should be part of a whitelist.
 | 64.0 | 80 | 80 | A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -91,6 +91,8 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
 | 63.0 | 70 | 90 | process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -91,6 +91,8 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th
 | 81.0 | 90 | 90 | A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -96,6 +96,8 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives.
 | 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -100,6 +100,8 @@ If you are seeing more results than desired, you may consider reducing the value



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -93,6 +93,8 @@ unknown
 | 63.0 | 70 | 90 | modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -97,6 +97,8 @@ You will encounter noise from legitimate print-monitor registry entries.
 | 64.0 | 80 | 80 | New print monitor added on $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -95,6 +95,8 @@ There are many legitimate applications that leverage shim databases for compatib
 | 56.0 | 70 | 80 | A registry activity in $registry_path$ related to shim modication in host $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -95,6 +95,8 @@ Limited to no false positives are expected.
 | 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -95,6 +95,8 @@ unknown
 | 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -95,6 +95,8 @@ unknown
 | 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -89,6 +89,8 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
 | 80.0 | 80 | 100 | $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -74,6 +74,8 @@ At this stage, there are no known false positives. During testing, no process ev



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -71,6 +71,8 @@ Uploading container is a normal behavior from developers or users with access to



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -99,6 +99,8 @@ None identified.
 | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -85,6 +85,8 @@ Some legitimate printer-related processes may show up as children of spoolsv.exe



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+

 #### CVE

@@ -89,6 +89,8 @@ Some legitimate processes may be only rarely executed in your environment. As th



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -86,6 +86,8 @@ Although unlikely, administrators may use wmi to execute commands for legitimate
 | 49.0 | 70 | 70 | A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -84,6 +84,8 @@ Although unlikely, administrators may use wmi to launch scripts for legitimate p
 | 36.0 | 60 | 60 | A wmic.exe process $process_name$ taht execute script in host $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -72,6 +72,8 @@ It is important to understand that if you happen to install any new applications



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -86,6 +86,8 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -87,6 +87,8 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -98,6 +98,8 @@ A new child process of zoom isn&#39;t malicious by that fact alone. Further inve
 | 64.0 | 80 | 80 | Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -88,6 +88,8 @@ Using multiple AWS accounts and roles is perfectly valid behavior. It&#39;s susp
 | 15.0 | 30 | 50 | AWS account $requestingAccountId$ is trying to access resource from some other account $requestedAccountId$, for the first time. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -83,6 +83,8 @@ When a legitimate new user logins for the first time, this activity will be dete
 | 30.0 | 50 | 60 | User $user$ is logging into the AWS console for the first time |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -70,6 +70,8 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -107,6 +107,8 @@ unknown
 | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -90,6 +90,8 @@ It is possible that an administrator created and deleted an account in a short t
 | 63.0 | 70 | 90 | A user account created or delete shortly in host $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -88,6 +88,8 @@ It is possible that these logs may be legitimately cleared by Administrators. Fi
 | 70.0 | 70 | 100 | Windows event logs cleared on $dest$ via EventCode $EventCode$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -90,6 +90,8 @@ Remote Desktop may be used legitimately by users on the network.



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -92,6 +92,8 @@ The activity may be legitimate. For this reason, it&#39;s best to verify the acc
 | 42.0 | 60 | 70 | A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -82,6 +82,8 @@ Not all unauthenticated requests are malicious, but frequency, User Agent, sourc



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -107,6 +107,8 @@ None identified. Attempts to disable security-related services should be identif
 | 20.0 | 40 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -95,6 +95,8 @@ It is possible that a legitimate user is experiencing an issue causing multiple
 | 36.0 | 60 | 60 | Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -91,6 +91,8 @@ It is likely that the outbound Server Message Block (SMB) traffic is legitimate,



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -98,6 +98,8 @@ It is not uncommon for outlook to write legitimate zip files to the disk.



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -92,6 +92,8 @@ Some legitimate applications may exhibit this behavior.
 | 35.0 | 70 | 50 | cmd.exe launching script interpreters on $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -83,6 +83,8 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -86,6 +86,8 @@ Administrators and users sometimes prefer backing up their email data by moving



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -88,6 +88,8 @@ The false-positive rate will vary based on how you set the deviation_threshold a



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -89,6 +89,8 @@ It is possible legitimate traffic can trigger this rule. Please investigate as a



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -92,6 +92,8 @@ A previously unseen service is not necessarily malicious. Verify that the servic



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -91,6 +91,8 @@ Some applications and users may legitimately use attrib.exe to interact with the
 | 72.0 | 90 | 80 | Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -87,6 +87,8 @@ The false-positive rate will vary based on how you set the deviation_threshold a



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -99,6 +99,8 @@ There may be legitimate reasons to bypass the PowerShell execution policy. The P
 | 42.0 | 70 | 60 | PowerShell local execution policy bypass attempt on $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -93,6 +93,8 @@ A single public IP address servicing multiple legitmate users may trigger this s



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -86,6 +86,8 @@ None. Account lockouts should be followed up on to determine if the actual user



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -89,6 +89,8 @@ There may be a faulty config preventing legitmate users from accessing apps they



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -89,6 +89,8 @@ Users in your enviornment may legitmately be travelling and loggin in from diffe



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -91,6 +91,8 @@ Microsoft may provide updates to these binaries. Verify that these changes do no
 | 72.0 | 80 | 90 | A suspicious file modification or replace in $file_path$  in host $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -86,6 +86,8 @@ None identified



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -86,6 +86,8 @@ None identified



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -87,6 +87,8 @@ RDP gateways may have unusually high amounts of traffic from all other hosts&#39



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -86,6 +86,8 @@ Remote Desktop may be used legitimately by users on the network.



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -97,6 +97,8 @@ Using sc.exe to manipulate Windows services is uncommon. However, there may be l
 | 56.0 | 70 | 80 | A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -83,6 +83,8 @@ It&#39;s possible that legitimate traffic will have long URLs or long user agent



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -89,6 +89,8 @@ A file server may experience high-demand loads that could cause this analytic to



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -95,6 +95,8 @@ If you are seeing more results than desired, you may consider reducing the value



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -94,6 +94,8 @@ None identified



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -98,6 +98,8 @@ It&#39;s possible for system administrators to write scripts that exhibit this b
 | 35.0 | 70 | 50 | Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -89,6 +89,8 @@ Because the Recycle Bin is a hidden folder in modern versions of Windows, it wou
 | 28.0 | 40 | 70 | Suspicious writes to windows Recycle Bin process $Processes.process_name$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -89,6 +89,8 @@ None at this time



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -92,6 +92,8 @@ You must be ingesting data that records process activity from your hosts to popu
 | 45.0 | 50 | 90 | Possible Sysmon filter driver unloading on $dest$ |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -77,6 +77,8 @@ Attach to policy can create a lot of noise. This search can be adjusted to provi



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -87,6 +87,8 @@ Not all permanent key creations are malicious. If there is a policy of rotating



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -92,6 +92,8 @@ CreateRole is not very common in common users. This search can be adjusted to pr



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -86,6 +86,8 @@ Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -85,6 +85,8 @@ Sts:GetSessionToken can be very noisy as in certain environments numerous calls



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
@@ -81,6 +81,8 @@ unknown



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+

 #### CVE

@@ -85,6 +85,8 @@ unknown



+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+

 #### CVE

@@ -107,6 +107,8 @@ It&#39;s possible that a new user will start to modify EC2 instances when they h
 | 42.0 | 70 | 60 | User $user$ is modifying an instance $dest$ for the first time. |


+Note that risk score is calculated base on the following formula: `(Impact * Confidence)/100`
+


 #### Reference
--- a/Show More
+++ b/Show More