diff --git a/bin/doc_gen.py b/bin/doc_gen.py index 1206d67eee..755127aca1 100644 --- a/bin/doc_gen.py +++ b/bin/doc_gen.py @@ -9,8 +9,18 @@ from jinja2 import Environment, FileSystemLoader import datetime from stix2 import FileSystemSource from stix2 import Filter +from pycvesearch import CVESearch +CVESSEARCH_API_URL = 'https://cve.circl.lu' +def get_cve_enrichment_new(cve_id): + cve = CVESearch(CVESSEARCH_API_URL) + result = cve.id(cve_id) + cve_enriched = dict() + cve_enriched['id'] = cve_id + cve_enriched['cvss'] = result['cvss'] + cve_enriched['summary'] = result['summary'] + return cve_enriched def get_all_techniques(projects_path): path_cti = path.join(projects_path,'cti/enterprise-attack') @@ -256,6 +266,14 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag mitre_attacks.append(mitre_attack) detection_yaml['mitre_attacks'] = mitre_attacks + # enrich the cve object + cves = [] + if 'cve' in detection_yaml['tags']: + for cve_id in detection_yaml['tags']['cve']: + cve = get_cve_enrichment_new(cve_id) + cves.append(cve) + detection_yaml['cve'] = cves + # grab the kind detection_yaml['kind'] = manifest_file.split('/')[-2] diff --git a/bin/generate.py b/bin/generate.py index 53d93f182d..910b1462af 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -67,7 +67,7 @@ def generate_transforms_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH): utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat() j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep - trim_blocks=True) + trim_blocks=True) template = j2_env.get_template('transforms.j2') output_path = path.join(OUTPUT_PATH, 'default/transforms.conf') output = template.render(lookups=sorted_lookups, time=utc_time) @@ -230,7 +230,7 @@ def get_deployments(object, deployments): for deployment in deployments: for tag in object['tags'].keys(): - + if tag in deployment['tags'].keys(): if type(object['tags'][tag]) is str: tag_array = [object['tags'][tag]] @@ -325,7 +325,7 @@ def add_annotations(detection): # changes to this data structure separate from the mappings generation # @todo expose the JSON data structure for newer risk type - annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story', 'observable', 'context', 'impact', 'confidence'] + annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story', 'observable', 'context', 'impact', 'confidence', 'cve'] savedsearch_annotations = {} for key in annotation_keys: if key == 'mitre_attack': @@ -364,7 +364,7 @@ def add_rba(detection): # determine if is a user type, create risk if entity['type'].lower() in risk_object_user_types: - + for r in entity['role']: if 'attacker' == r.lower() or 'victim' ==r.lower(): @@ -376,10 +376,10 @@ def add_rba(detection): # determine if is a system type, create risk elif entity['type'].lower() in risk_object_system_types: - + for r in entity['role']: if 'attacker' == r.lower() or 'victim' ==r.lower(): - + risk_object['risk_object_type'] = 'system' risk_object['risk_object_field'] = entity['name'] risk_object['risk_score'] = detection['tags']['risk_score'] @@ -393,12 +393,12 @@ def add_rba(detection): continue detection['risk'] = risk_objects - + return detection def add_playbook(detection, playbooks): preface = " The following Splunk SOAR playbook can be used to respond to this detection: " - + for playbook in playbooks: if detection['name'] in playbook['tags']['detections']: detection['how_to_implement'] = detection['how_to_implement'] + preface + playbook['name'] @@ -456,7 +456,7 @@ def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH): if key in detection['tags']: mappings[key] = detection['tags'][key] detection['mappings'] = mappings - + detection = add_annotations(detection) detection = add_rba(detection) detection = add_playbook(detection, playbooks) @@ -698,7 +698,7 @@ if __name__ == "__main__": parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output") parser.add_argument("--product", required=True, default="ESCU", help="package type") - + # parse them args = parser.parse_args() REPO_PATH = args.path @@ -706,4 +706,4 @@ if __name__ == "__main__": VERBOSE = args.verbose PRODUCT = args.product - main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE) \ No newline at end of file + main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE) diff --git a/bin/jinja2_templates/doc_detections_markdown.j2 b/bin/jinja2_templates/doc_detections_markdown.j2 index b51709bb09..cc8e1185d3 100644 --- a/bin/jinja2_templates/doc_detections_markdown.j2 +++ b/bin/jinja2_templates/doc_detections_markdown.j2 @@ -23,6 +23,9 @@ tags: {%- for product in detection.tags.product %} - {{ product }} {%- endfor -%} +{%- for cve in detection.cve %} + - {{ cve.id }} +{%- endfor -%} {%- for datamodel in detection.datamodel %} - {{ datamodel }} {%- endfor -%} @@ -53,16 +56,16 @@ We have not been able to test, simulate or build datasets for it, use at your ow #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | {% for attack in detection.mitre_attacks -%} {% if attack.technique_id -%} {%- set sub_technique = attack.technique_id.split('.') -%}{%- if sub_technique | length > 1 -%} | [{{ attack.technique_id }}](https://attack.mitre.org/techniques/{{sub_technique[0]}}/{{sub_technique[1]}}/) | {{ attack.technique }} | {{ attack.tactic|join(', ') }} | -{%- else -%} +{% else %} | [{{ attack.technique_id }}](https://attack.mitre.org/techniques/{{attack.technique_id}}/) | {{ attack.technique }} | {{ attack.tactic|join(', ') }} | -{% endif -%} -{%- endif -%} -{%- endfor %} +{% endif %} +{% endif %} +{% endfor %} {% endif %} #### Search @@ -92,14 +95,22 @@ We have not been able to test, simulate or build datasets for it, use at your ow #### Known False Positives {{ detection.known_false_positives}} - {% if detection.tags.observable %} #### RBA | Risk Score | Impact | Confidence | Message | | ----------- | ----------- |--------------|--------------| | {{(detection.tags.impact * detection.tags.confidence)/100}} | {{ detection.tags.impact }} | {{ detection.tags.confidence }} | {{detection.tags.message}} | +{% endif %} +{% if detection.cve %} +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +{% for cve in detection.cve -%} +| [{{ cve.id }}](https://nvd.nist.gov/vuln/detail/{{cve.id}}) | {{ cve.summary }} | {{ cve.cvss }} | +{% endfor %} {% endif %} #### Reference @@ -117,5 +128,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith * [{{dataset}}]({{ dataset }}) {% endfor %} - [*source*](https://github.com/splunk/security_content/tree/develop/detections/{% if detection.experimental is sameas true -%}experimental/{%- endif -%}{{detection.kind}}/{{ detection.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{detection.version}}** diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index d74243965c..8103763921 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-30T19:01:48 UTC +# On Date: 2021-10-26T01:24:23 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -286,7 +286,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Enable WDigest UseLogonCredential Registry - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -399,7 +399,7 @@ version = 1 references = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"] maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Circle CI Disable Security Job - Rule", "ESCU - Circle CI Disable Security Step - Rule", "ESCU - Correlation by Repository and Risk - Rule", "ESCU - Correlation by User and Risk - Rule", "ESCU - GitHub Dependabot Alert - Rule", "ESCU - GitHub Pull Request from Unknown User - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"] +searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Circle CI Disable Security Job - Rule", "ESCU - Circle CI Disable Security Step - Rule", "ESCU - Correlation by Repository and Risk - Rule", "ESCU - Correlation by User and Risk - Rule", "ESCU - GSuite Email Suspicious Attachment - Rule", "ESCU - GitHub Dependabot Alert - Rule", "ESCU - GitHub Pull Request from Unknown User - Rule", "ESCU - Github Commit Changes In Master - Rule", "ESCU - Github Commit In Develop - Rule", "ESCU - Gsuite Drive Share In External Email - Rule", "ESCU - Gsuite Email Suspicious Subject With Attachment - Rule", "ESCU - Gsuite Email With Known Abuse Web Service Link - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - Gsuite Suspicious Shared File Name - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"] description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor. narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter. @@ -467,7 +467,7 @@ version = 1 references = ["https://en.wikipedia.org/wiki/FIN7", "https://threatpost.com/fin7-windows-11-release/169206/", "https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded"] maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}] spec_version = 3 -searches = ["ESCU - Check Elevated CMD using whoami - Rule", "ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Jscript Execution Using Cscript App - Rule", "ESCU - MS Scripting Process Loading Ldap Module - Rule", "ESCU - MS Scripting Process Loading WMI Module - Rule", "ESCU - Non Chrome Process Accessing Chrome Default Dir - Rule", "ESCU - Non Firefox Process Access Firefox Profile Dir - Rule", "ESCU - Office Application Drop Executable - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - XSL Script Execution With WMIC - Rule"] +searches = ["ESCU - Check Elevated CMD using whoami - Rule", "ESCU - Cmdline Tool Not Executed In CMD Shell - Rule", "ESCU - Jscript Execution Using Cscript App - Rule", "ESCU - MS Scripting Process Loading Ldap Module - Rule", "ESCU - MS Scripting Process Loading WMI Module - Rule", "ESCU - Non Chrome Process Accessing Chrome Default Dir - Rule", "ESCU - Non Firefox Process Access Firefox Profile Dir - Rule", "ESCU - Office Application Drop Executable - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Vbscript Execution Using Wscript App - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule", "ESCU - XSL Script Execution With WMIC - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated with its payload, data collection and script execution. narrative = FIN7 is a Russian criminal advanced persistent threat group that has primarily targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. A portion of FIN7 is run out of the front company Combi Security. It has been called one of the most successful criminal hacking groups in the world. this passed few day FIN7 tools and implant are seen in the wild where its code is updated. the FIN& is known to use the spear phishing attack as a entry to targetted network or host that will drop its staging payload like the JS and JSSloader. Now this artifacts and implants seen downloading other malware like cobaltstrike and event ransomware to encrypt host. @@ -624,7 +624,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1036/003/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule"] +searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Sdelete Application Execution - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule"] description = Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. narrative = Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths.\ The following content is here to assist with binaries within `system32` or `syswow64` being moved to a new location or an adversary bringing a the binary in to execute.\ @@ -816,7 +816,7 @@ references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-resear maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 searches = ["ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"] -description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Ransomware Investigate and Contain' +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Ransomware Investigate and Contain' narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. [analytic_story://Ransomware Cloud] @@ -837,7 +837,7 @@ version = 1 references = ["https://success.trendmicro.com/solution/1123281-remcos-malware-information", "https://attack.mitre.org/software/S0332/", "https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos#:~:text=Remcos%20(acronym%20of%20Remote%20Control,used%20to%20remotely%20control%20computers.\u0026text=Remcos%20can%20be%20used%20for,been%20used%20in%20hacking%20campaigns."] maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}] spec_version = 3 -searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remcos RAT File Creation in Remcos Folder - Rule", "ESCU - Suspicious Image Creation In Appdata Folder - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious WAV file in Appdata Folder - Rule"] +searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Malicious InProcServer32 Modification - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Process Writing DynamicWrapperX - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remcos RAT File Creation in Remcos Folder - Rule", "ESCU - Remcos client registry install entry - Rule", "ESCU - Suspicious Image Creation In Appdata Folder - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Suspicious WAV file in Appdata Folder - Rule", "ESCU - Vbscript Execution Using Wscript App - Rule", "ESCU - Winhlp32 Spawning a Process - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection.. narrative = Remcos or Remote Control and Surveillance, marketed as a legitimate software for remotely managing Windows systems is now widely used in multiple malicious campaigns both APT and commodity malware by threat actors. @@ -1133,7 +1133,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1218/010/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md", "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule"] +searches = ["ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Malicious InProcServer32 Modification - Rule", "ESCU - Regsvr32 Silent Param Dll Loading - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule"] description = Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code. narrative = One common adversary tactic is to bypass application control solutions via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo" using the "scrobj.dll" dll to load .sct scriptlets. This technique is still widely used by adversaries to bypass detection and prevention controls. The file extension of the DLL is irrelevant (it may load a .txt file extension for example). The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. Validate execution Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect. Determine if script code was executed with regsvr32. Situational Awareness - The objective of this step is meant to identify suspicious behavioral indicators related to executed of Script code by regsvr32.exe. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? Module loads. Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths. Network connections. Any network connections? Review the reputation of the remote IP or domain. Retrieval of Script Code - confirm the executed script code is benign or malicious. @@ -1166,7 +1166,7 @@ version = 1 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\ The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\ @@ -1214,7 +1214,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1127/001/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md", "https://github.com/infosecn1nja/MaliciousMacroMSBuild", "https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1", "https://lolbas-project.github.io/lolbas/Binaries/Msbuild/", "https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious msbuild path - Rule"] +searches = ["ESCU - MSBuild Suspicious Spawned By Script Process - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious msbuild path - Rule"] description = Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. narrative = Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.\ The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.\ @@ -1238,7 +1238,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - Suspicious Copy on System32 - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Verclsid CLSID Execution - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Wscript Or Cscript Suspicious Child Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\ @@ -1273,7 +1273,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1311,7 +1311,7 @@ version = 2 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -1322,7 +1322,7 @@ version = 2 references = ["https://attack.mitre.org/tactics/TA0004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Active Setup Registry Autostart - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment. @@ -1358,7 +1358,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious 7z process with commandline pointing to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z to archive a sensitive files and place it in network share tmp folder. This search is a good hunting query that may give analyst a hint why specific user try to archive a file pointing to SMB user which is un usual. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used. -annotations = {"analytic_story": ["Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"]} known_false_positives = unknown providing_technologies = [] @@ -1368,7 +1368,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. -annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new city is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your city, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. providing_technologies = [] @@ -1379,7 +1379,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. -annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching over plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new country is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. providing_technologies = [] @@ -1390,7 +1390,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. -annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} +annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. providing_technologies = [] @@ -1401,7 +1401,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. -annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new region is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your region, there should be few false positives. If you are located in regions where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. providing_technologies = [] @@ -1412,7 +1412,7 @@ asset_type = AWS Account confidence = medium explanation = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 70, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources providing_technologies = [] @@ -1422,7 +1422,7 @@ asset_type = AWS Account confidence = medium explanation = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 90, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. providing_technologies = [] @@ -1432,7 +1432,7 @@ asset_type = AWS Account confidence = medium explanation = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user. providing_technologies = [] @@ -1442,7 +1442,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for AssumeRole events where an IAM role in a different account is requested for the first time. how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen AWS Cross Account Activity - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen AWS Cross Account Activity - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `aws_cross_account_activity_from_previously_unseen_account_filter` macro. -annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"], "observable": [{"name": "requestingAccountId", "role": ["Attacker"], "type": "Other"}, {"name": "requestedAccountId", "role": ["Victim"], "type": "Other"}]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"]} known_false_positives = Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request. providing_technologies = [] @@ -1452,7 +1452,7 @@ asset_type = AWS Account confidence = medium explanation = This search provides detection of KMS keys where action kms:Encrypt is accessible for everyone (also outside of your organization). This is an indicator that your account is compromised and the attacker uses the encryption key to compromise another company. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs -annotations = {"analytic_story": ["Ransomware Cloud"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "mitre_attack": ["T1486"], "observable": [{"name": "userIdentity.principalId", "role": ["Attacker"], "type": "User"}]} +annotations = {"mitre_attack": ["T1486"]} known_false_positives = unknown providing_technologies = [] @@ -1462,7 +1462,7 @@ asset_type = S3 Bucket confidence = medium explanation = This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs -annotations = {"analytic_story": ["Ransomware Cloud"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1486"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest_file", "role": ["Target"], "type": "File"}]} +annotations = {"mitre_attack": ["T1486"]} known_false_positives = bucket with S3 encryption providing_technologies = [] @@ -1472,7 +1472,7 @@ asset_type = AWS Account confidence = medium explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "image", "role": ["Victim"], "type": "System"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -1482,7 +1482,7 @@ asset_type = AWS Account confidence = medium explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -1492,7 +1492,7 @@ asset_type = AWS Account confidence = medium explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "image", "role": ["Victim"], "type": "System"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -1502,7 +1502,7 @@ asset_type = AWS Account confidence = medium explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = When your development is spreaded in different time zones, applying this rule can be difficult. providing_technologies = [] @@ -1512,7 +1512,7 @@ asset_type = AWS Account confidence = medium explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -1522,7 +1522,7 @@ asset_type = AWS EKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets how_to_implement = You must install Splunk Add-on for Amazon Web Services and Splunk App for AWS. This search works with cloudwatch logs. -annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection. providing_technologies = [] @@ -1532,7 +1532,7 @@ asset_type = AWS Account confidence = medium explanation = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:Inbound", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives. providing_technologies = [] @@ -1542,7 +1542,7 @@ asset_type = confidence = medium explanation = The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen and is being misused to perform discovery events. In these instances, the access is not available with the key stolen therefore these events will be generated. how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Blocked", "Stage:Discovery"], "impact": 20, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "userIdentity.arn", "role": ["Attacker"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580"]} known_false_positives = It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives. providing_technologies = [] @@ -1552,7 +1552,7 @@ asset_type = confidence = medium explanation = The following detection identifies any malformed policy document exceptions with a status of `failure`. A malformed policy document exception occurs in instances where roles are attempted to be assumed, or brute forced. In a brute force attempt, using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning, when an adversary is attempting to identify a role name, multiple failures will occur. This detection focuses on the errors of a remote attempt that is failing. how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment. -annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "confidence": 70, "context": ["Source:Cloud Data", "Scope:Inbound", "Stage:Credential Access", "Other:Policy Violation"], "impact": 40, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580", "T1110"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580", "T1110"]} known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. providing_technologies = [] @@ -1562,7 +1562,7 @@ asset_type = confidence = medium explanation = The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story of suspicious attempts. There is a specific process to follow when deleting a policy. First, detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy. how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution", "Other:Policy Violation"], "impact": 20, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"]} known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only. providing_technologies = [] @@ -1572,7 +1572,7 @@ asset_type = confidence = medium explanation = This detection identifies failure attempts to delete groups. We want to identify when a group is attempting to be deleted, but either access is denied, there is a conflict or there is no group. This is indicative of administrators performing an action, but also could be suspicious behavior occurring. Review parallel IAM events - recently added users, new groups and so forth. how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution"], "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}, {"name": "group_name", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"]} known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege). providing_technologies = [] @@ -1582,7 +1582,7 @@ asset_type = confidence = medium explanation = The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner. how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution"], "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1069.003", "T1098"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}, {"name": "group_deleted", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1069.003", "T1098", "T1069"]} known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege). providing_technologies = [] @@ -1592,7 +1592,7 @@ asset_type = AWS Instance confidence = medium explanation = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs. -annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "userName", "role": ["Victim"], "type": "User"}, {"name": "requestParameters.cidrBlock", "role": ["Victim"], "type": "IP Address"}]} +annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment. providing_technologies = [] @@ -1602,7 +1602,7 @@ asset_type = AWS Instance confidence = medium explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. -annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution"], "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that a user has legitimately deleted a network ACL. providing_technologies = [] @@ -1612,7 +1612,7 @@ asset_type = AWS Federated Account confidence = medium explanation = This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs -annotations = {"analytic_story": ["Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Stage:Credential Access", "Stage:Privilege Escalation"], "impact": 80, "mitre_attack": ["T1078"], "observable": [{"name": "sourceIPAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "recipientAccountId", "role": ["Victim", "Target"], "type": "Other"}]} +annotations = {"mitre_attack": ["T1078"]} known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. providing_technologies = [] @@ -1622,7 +1622,7 @@ asset_type = AWS Federated Account confidence = medium explanation = This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Stage:Credential Access"], "impact": 80, "mitre_attack": ["T1078"], "observable": [{"name": "sourceIPAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "userIdentity.principalId", "role": ["Victim", "Target"], "type": "User"}]} +annotations = {"mitre_attack": ["T1078"]} known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. providing_technologies = [] @@ -1632,7 +1632,7 @@ asset_type = AWS Account confidence = medium explanation = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Credential Access", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources providing_technologies = [] @@ -1642,7 +1642,7 @@ asset_type = AWS Account confidence = medium explanation = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 60, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. providing_technologies = [] @@ -1652,7 +1652,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. -annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. providing_technologies = [] @@ -1662,7 +1662,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. -annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. providing_technologies = [] @@ -1672,7 +1672,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. -annotations = {"analytic_story": ["Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured with your AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify whether this search alerted on a human user. providing_technologies = [] @@ -1682,7 +1682,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment. -annotations = {"analytic_story": ["Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. providing_technologies = [] @@ -1692,7 +1692,7 @@ asset_type = AWS Instance confidence = medium explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user. how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function. -annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = providing_technologies = [] @@ -1702,7 +1702,7 @@ asset_type = Cloud Instance confidence = medium explanation = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function. -annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. providing_technologies = [] @@ -1712,7 +1712,7 @@ asset_type = Cloud Instance confidence = medium explanation = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function. -annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user. providing_technologies = [] @@ -1722,7 +1722,7 @@ asset_type = AWS Instance confidence = medium explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user. how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model. -annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:Inbound", "Outcome:Allowed", "Stage:Execution", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = providing_technologies = [] @@ -1732,7 +1732,7 @@ asset_type = Windows confidence = medium explanation = Detect memory dumping of the LSASS process. how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "TargetImage", "role": ["Target"], "type": "Process"}]} +annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]} known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. providing_technologies = [] @@ -1742,17 +1742,27 @@ asset_type = confidence = medium explanation = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.. -annotations = {"analytic_story": ["Trickbot", "IcedID"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 10, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Process"], "type": "Process Name"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = admin or power user may used this series of command. providing_technologies = [] +[savedsearch://ESCU - Active Setup Registry Autostart - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.014", "T1547"]} +known_false_positives = Active setup installer may add or modify this registry. +providing_technologies = [] + [savedsearch://ESCU - Add DefaultUser And Password In Registry - Rule] type = detection asset_type = confidence = medium explanation = this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["BlackMatter Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002", "T1552"]} known_false_positives = unknown providing_technologies = [] @@ -1762,7 +1772,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -1772,7 +1782,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious modification of firewall to allow file and printer sharing. This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007"]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"]} known_false_positives = network admin may modify this firewall feature that may cause this rule to be triggered. providing_technologies = [] @@ -1782,7 +1792,7 @@ asset_type = confidence = medium explanation = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"]} known_false_positives = network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. providing_technologies = [] @@ -1792,7 +1802,7 @@ asset_type = confidence = medium explanation = The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. -annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"]} known_false_positives = administrator may allow inbound traffic in certain network or machine. providing_technologies = [] @@ -1802,7 +1812,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host to encrypt more files. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007"]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"]} known_false_positives = network admin may modify this firewall feature that may cause this rule to be triggered. providing_technologies = [] @@ -1812,7 +1822,7 @@ asset_type = confidence = medium explanation = This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -annotations = {"analytic_story": ["Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]} known_false_positives = unknown providing_technologies = [] @@ -1822,7 +1832,7 @@ asset_type = Amazon EKS Kubernetes cluster Pod confidence = medium explanation = This search provides detection information on unauthenticated requests against Kubernetes' Pods API how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on forAWS (version 4.4.0 or later), then configure your AWS CloudWatch EKS Logs.Please also customize the `kubernetes_pods_aws_scan_fingerprint_detection` macro to filter out the false positives. -annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} known_false_positives = Not all unauthenticated requests are malicious, but frequency, UA and source IPs and direct request to API provide context. providing_technologies = [] @@ -1832,7 +1842,7 @@ asset_type = Amazon EKS Kubernetes cluster confidence = medium explanation = This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster in AWS how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudWatch EKS Logs inputs. -annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} known_false_positives = Not all unauthenticated requests are malicious, but frequency, UA and source IPs will provide context. providing_technologies = [] @@ -1842,7 +1852,7 @@ asset_type = confidence = medium explanation = The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`. It has been observed where an adversary will rename `7z.exe`. Additional coverage may be required to identify the behavior of renamed instances of `7z.exe`. During triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture any files written to disk and analyze as needed. Review parallel processes for additional behaviors. Typically, archiving files will result in exfiltration. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Cobalt Strike", "NOBELIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1560.001", "T1560"]} known_false_positives = False positives should be limited as this behavior is not normal for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip. providing_technologies = [] @@ -1852,7 +1862,7 @@ asset_type = confidence = medium explanation = The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Malicious PowerShell", "Ingress Tool Transfer"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Exploitation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} known_false_positives = False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage. providing_technologies = [] @@ -1862,7 +1872,7 @@ asset_type = confidence = medium explanation = The following analytic identifies the use of PowerShell downloading a file using `DownloadString` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Malicious PowerShell", "HAFNIUM Group", "Ingress Tool Transfer"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} known_false_positives = False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage. providing_technologies = [] @@ -1872,7 +1882,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for execution of commonly used attacker tools on an endpoint. how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. -annotations = {"analytic_story": ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"], "cis20": ["CIS 2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exploitation", "Stage:Recon", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1595", "T1003"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process", "Attacker"], "type": "Process"}]} +annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1036", "T1003", "T1595"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = Some administrator activity can be potentially triggered, please add those users to the filter macro. providing_technologies = [] @@ -1882,7 +1892,7 @@ asset_type = Endpoint confidence = medium explanation = Attempt To Add Certificate To Untrusted Store how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004", "T1553"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} known_false_positives = There may be legitimate reasons for administrators to add a certificate to the untrusted certificate store. In such cases, this will typically be done on a large number of systems. providing_technologies = [] @@ -1892,7 +1902,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for attempts to stop security-related services on the endpoint. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Disabling Security Tools", "Trickbot"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} known_false_positives = None identified. Attempts to disable security-related services should be identified and understood. providing_technologies = [] @@ -1902,7 +1912,7 @@ asset_type = Endpoint confidence = medium explanation = Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"]} known_false_positives = None identified. providing_technologies = [] @@ -1912,7 +1922,7 @@ asset_type = confidence = medium explanation = this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["BlackMatter Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002", "T1552"]} known_false_positives = unknown providing_technologies = [] @@ -1922,7 +1932,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. Tune based on parent process names. -annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Impact"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"]} known_false_positives = Administrators may modify the boot configuration. providing_technologies = [] @@ -1932,7 +1942,7 @@ asset_type = confidence = medium explanation = The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["BITS Jobs"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"]} known_false_positives = Limited false positives will be present. Typically, applications will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments (legitimate applications) or parent process. providing_technologies = [] @@ -1942,7 +1952,7 @@ asset_type = confidence = medium explanation = The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from `bitsadmin.exe`, but the artifacts will appear in a parallel process of `svchost.exe` with a command-line similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", "T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", "T1105"]} known_false_positives = Limited false positives, however it may be required to filter based on parent process name or network connection. providing_technologies = [] @@ -1952,7 +1962,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks for a batch file (.bat) written to the Windows system directory tree. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204", "T1204.002"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It is possible for this search to generate a notable event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. providing_technologies = [] @@ -1962,7 +1972,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using bcdedit deletevalue command. This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["BlackMatter Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Impact"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = unknown providing_technologies = [] @@ -1972,7 +1982,7 @@ asset_type = confidence = medium explanation = This search is to detect execution of chcp.exe application. this utility is used to change the active code page of the console. This technique was seen in icedid malware to know the locale region/language/country of the compromise host. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed chcp.com may be used. -annotations = {"analytic_story": ["IcedID"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059"]} known_false_positives = other tools or script may used this to change code page to UTF-* or others providing_technologies = [] @@ -1982,7 +1992,7 @@ asset_type = confidence = medium explanation = This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059", "T1059.003", "T1543.003", "T1543"]} known_false_positives = Unknown. It is possible filtering may be required to ensure fidelity. providing_technologies = [] @@ -1992,7 +2002,7 @@ asset_type = confidence = medium explanation = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Other"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"]} known_false_positives = Legitimate windows application that are not on the list loading this dll. Filter as needed. providing_technologies = [] @@ -2002,7 +2012,7 @@ asset_type = confidence = medium explanation = Certutil.exe may download a file from a remote destination using `-urlcache`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command and Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} known_false_positives = Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection. providing_technologies = [] @@ -2012,7 +2022,7 @@ asset_type = confidence = medium explanation = Certutil.exe may download a file from a remote destination using `-VerifyCtl`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for `certutil.exe` to contact public IP space. \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using `-VerifyCtl`, the file will either be written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command and Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} known_false_positives = Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection. providing_technologies = [] @@ -2022,7 +2032,7 @@ asset_type = confidence = medium explanation = CertUtil.exe may be used to `encode` and `decode` a file, including PE and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded file that was downloaded. Once decoded, it will be loaded by a parallel process. Note that there are two additional command switches that may be used - `encodehex` and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Deobfuscate-Decode Files or Information"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"]} known_false_positives = Typically seen used to `encode` files, but it is possible to see legitimate use of `decode`. Filter based on parent-child relationship, file paths, endpoint or user. providing_technologies = [] @@ -2032,17 +2042,27 @@ asset_type = Endpoint confidence = medium explanation = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Installation"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Installation"]} known_false_positives = Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. providing_technologies = [] +[savedsearch://ESCU - Change Default File Association - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other payload that will load malicious command to the compromised host. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.001", "T1546"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Change To Safe Mode With Network Config - Rule] type = detection asset_type = confidence = medium explanation = This search is to detect a suspicious bcdedit commandline to configure the host to boot in safe mode with network config. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using bcdedit deletevalue command. This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["BlackMatter Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Impact"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = unknown providing_technologies = [] @@ -2052,7 +2072,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious whoami execution to check if the cmd or shell instance process is with elevated privileges. This technique was seen in FIN7 js implant where it execute this as part of its data collection to the infected machine to check if the running shell cmd process is elevated or not. This TTP is really a good alert for known attacker that recon on the targetted host. This command is not so commonly executed by a normal user or even an admin to check if a process is elevated. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["FIN7"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"]} known_false_positives = unknown providing_technologies = [] @@ -2062,7 +2082,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for child processes of spoolsv.exe. This activity is associated with a POC privilege-escalation exploit associated with CVE-2018-8440. Spoolsv.exe is the process associated with the Print Spooler service in Windows and typically runs as SYSTEM. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Update the `children_of_spoolsv_filter` macro to filter out legitimate child processes spawned by spoolsv.exe. -annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 5", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["PR.AC", "PR.PT", "DE.CM"]} +annotations = {"cis20": ["CIS 5", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["PR.AC", "PR.PT", "DE.CM"]} known_false_positives = Some legitimate printer-related processes may show up as children of spoolsv.exe. You should confirm that any activity as legitimate and may be added as exclusions in the search. providing_technologies = [] @@ -2072,7 +2092,7 @@ asset_type = CircleCI confidence = medium explanation = This search looks for disable security job in CircleCI pipeline. how_to_implement = You must index CircleCI logs. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2082,7 +2102,7 @@ asset_type = CircleCI confidence = medium explanation = This search looks for disable security step in CircleCI pipeline. how_to_implement = You must index CircleCI logs. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2092,7 +2112,7 @@ asset_type = confidence = medium explanation = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Impact"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004", "T1070"]} known_false_positives = administrator may execute this app to manage disk providing_technologies = [] @@ -2104,7 +2124,7 @@ explanation = WARNING, this detection has been marked deprecated by the Splunk T how_to_implement = This search requires that DNS data is being ingested and populating the `Network_Resolution` data model. This data can come from DNS logs or from solutions that parse network traffic for this data, such as Splunk Stream or Bro.\ This search produces fields (`dest_count`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** Distinct DNS Connections, **Field:** dest_count\ Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` -annotations = {"analytic_story": ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"], "cis20": ["CIS 9", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "PR.DS"]} +annotations = {"cis20": ["CIS 9", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "PR.DS"]} known_false_positives = It's possible that an enterprise has more than five DNS servers that are configured in a round-robin rotation. Please customize the search, as appropriate. providing_technologies = [] @@ -2114,7 +2134,7 @@ asset_type = confidence = medium explanation = The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files in network shares and if it is "temp.dat", it will try to read from some stream pipe or file start encrypting files within the infected local machines. This technique can be also identified as an anti-sandbox technique to make its code non-responsive since it is waiting for some parameter to execute properly. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 100, "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"]} known_false_positives = Operators can execute third party tools using these parameters. providing_technologies = [] @@ -2124,7 +2144,7 @@ asset_type = confidence = medium explanation = This detection is to identify the common service name created by the CLOP ransomware as part of its persistence and high privilege code execution in the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API in creating this service entry. how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 100, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1543"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1543"]} known_false_positives = unknown providing_technologies = [] @@ -2134,7 +2154,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for new commands from each user role. how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud API Calls Per User Role - Initial` to build the initial table of user roles, commands, and times. You must also enable the second baseline search `Previously Seen Cloud API Calls Per User Role - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_api_calls_from_previously_unseen_user_roles_filter` -annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} known_false_positives = . providing_technologies = [] @@ -2144,7 +2164,7 @@ asset_type = Cloud Compute Instance confidence = medium explanation = This search looks for cloud compute instances created by users who have not created them before. how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users. -annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1078.004"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"]} known_false_positives = It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior. providing_technologies = [] @@ -2154,7 +2174,7 @@ asset_type = Cloud Compute Instance confidence = medium explanation = This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created. how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Regions - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` macro. -annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 12"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "user"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate. providing_technologies = [] @@ -2164,7 +2184,7 @@ asset_type = Cloud Compute Instance confidence = medium explanation = This search looks for cloud compute instances being created with previously unseen image IDs. how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Images - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Images - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter` macro. -annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} known_false_positives = After a new image is created, the first systems created with that image will cause this alert to fire. Verify that the image being used was created by a legitimate user. providing_technologies = [] @@ -2174,7 +2194,7 @@ asset_type = Cloud Compute Instance confidence = medium explanation = Find EC2 instances being created with previously unseen instance types. how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Instance Types - Initial` to build the initial table of instance types observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Instance Types - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` macro. -annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} known_false_positives = It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type. providing_technologies = [] @@ -2184,7 +2204,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for cloud instances being modified by users who have not previously modified them. how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search "Previously Seen Cloud Instance Modifications By User - Update" should be enabled for this detection to properly work. -annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078.004"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"]} known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior. providing_technologies = [] @@ -2194,7 +2214,7 @@ asset_type = Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You can also provide additional filtering for this search by customizing the `cloud_network_access_control_list_deleted_filter` macro. -annotations = {"analytic_story": ["Cloud Network ACL Activity"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that a user has legitimately deleted a network ACL. providing_technologies = [] @@ -2204,7 +2224,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something. how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter` macro. -annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. providing_technologies = [] @@ -2215,7 +2235,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something. how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro. -annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. providing_technologies = [] @@ -2226,7 +2246,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something. how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` macro. -annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object_id", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. providing_technologies = [] @@ -2237,7 +2257,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something. how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter` macro. -annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\ This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. providing_technologies = [] @@ -2248,7 +2268,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious parent process execution of commandline tool not in shell commandline. This technique was seen in FIN7 JSSLoader .net compile payload where it run ipconfig.exe and systeminfo.exe using .net application. This event cause some good TTP since those tool are commonly run in commandline not by another application. This TTP is a good indicator for application gather host information either an attacker or an automated tool made by admin. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["FIN7"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]} known_false_positives = network operator or admin may create this type of tool to gather host information providing_technologies = [] @@ -2259,7 +2279,7 @@ confidence = medium explanation = The following analytic identifies the use of default or publicly known named pipes used with Cobalt Strike. A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. Cobalt Strike uses named pipes in many ways and has default values used with the Artifact Kit and Malleable C2 Profiles. The following query assists with identifying these default named pipes. Each EDR product presents named pipes a little different. Consider taking the values and generating a query based on the product of choice. \ Upon triage, review the process performing the named pipe. If it is explorer.exe, It is possible it was injected into by another process. Review recent parallel processes to identify suspicious patterns or behaviors. A parallel process may have a network connection, review and follow the connection back to identify any file modifications. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1055"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Parent Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1055"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some of the named pipes identified and added may cause false positives. Filter by process name or pipe name to reduce false positives. providing_technologies = [] @@ -2273,7 +2293,7 @@ This search produces fields (`query`,`query_length`,`count`) that are not yet su 1. \ 1. **Label:** File Extension, **Field:** file_extension\ Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` -annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions. providing_technologies = [] @@ -2283,7 +2303,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks for files created with names matching those typically used in ransomware notes that tell the victim how to get their data back. how_to_implement = You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. -annotations = {"analytic_story": ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It's possible that a legitimate file could be created with the same name used by ransomware note files. providing_technologies = [] @@ -2293,7 +2313,7 @@ asset_type = confidence = medium explanation = This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. The following Splunk SOAR playbook can be used to respond to this detection: Ransomware Investigate and Contain -annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} known_false_positives = 3rd party tool may have commandline parameter that can trigger this detection. providing_technologies = [] @@ -2303,7 +2323,7 @@ asset_type = confidence = medium explanation = The following detection identifies control.exe loading either a .cpl or .inf from a writable directory. This is related to CVE-2021-40444. During triage, review parallel processes, parent and child, for further suspicious behaviors. In addition, capture file modifications and analyze. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.002"]} known_false_positives = Limited false positives will be present as control.exe does not natively load from writable paths as defined. One may add .cpl or .inf to the command-line if there is any false positives. Tune as needed. providing_technologies = [] @@ -2313,7 +2333,7 @@ asset_type = AWS Account confidence = medium explanation = This search correlations detections by repository and risk_score how_to_implement = For Dev Sec Ops POC -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2323,7 +2343,7 @@ asset_type = AWS Account confidence = medium explanation = This search correlations detections by user and risk_score how_to_implement = For Dev Sec Ops POC -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2333,7 +2353,7 @@ asset_type = confidence = medium explanation = This search is to detect suspicious process injection in command shell. This technique was seen in IcedID where it execute cmd.exe process to inject its shellcode as part of its execution as banking trojan. It is really uncommon to have a create remote thread execution in the following application. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = unknown providing_technologies = [] @@ -2343,7 +2363,7 @@ asset_type = Windows confidence = medium explanation = Detect remote thread creation into LSASS consistent with credential dumping. how_to_implement = This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "TargetImage", "role": ["Other"], "type": "Other"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]} known_false_positives = Other tools can access LSASS for legitimate reasons and generate an event. In these cases, tweaking the search may help eliminate noise. providing_technologies = [] @@ -2353,7 +2373,7 @@ asset_type = confidence = medium explanation = This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"], "observable": [{"name": "Service_File_Name", "role": ["Other"], "type": "Other"}, {"name": "Service_Name", "role": ["Other"], "type": "Other"}]} +annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569", "T1569.002"]} known_false_positives = unknown providing_technologies = [] @@ -2363,7 +2383,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for the creation of local administrator accounts using net.exe . how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Administrators often leverage net.exe to create admin accounts. providing_technologies = [] @@ -2373,7 +2393,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for the creation or deletion of hidden shares using net.exe. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.005"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate. providing_technologies = [] @@ -2383,7 +2403,7 @@ asset_type = Endpoint confidence = medium explanation = Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]} known_false_positives = Legitimate administrator usage of Vssadmin or Wmic will create false positives. providing_technologies = [] @@ -2393,7 +2413,7 @@ asset_type = Endpoint confidence = medium explanation = This search detects the use of wmic and Powershell to create a shadow copy. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]} known_false_positives = Legtimate administrator usage of wmic to create a shadow copy. providing_technologies = [] @@ -2403,7 +2423,7 @@ asset_type = Windows confidence = medium explanation = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetFilename", "role": ["Victim"], "type": "File Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]} known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. providing_technologies = [] @@ -2413,7 +2433,7 @@ asset_type = Endpoint confidence = medium explanation = This search detects credential dumping using copy command from a shadow copy. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2423,7 +2443,7 @@ asset_type = Endpoint confidence = medium explanation = This search detects the creation of a symlink to a shadow copy. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2433,7 +2453,7 @@ asset_type = confidence = medium explanation = The following analytic identifies DLLHost.exe with no command line arguments with a network connection. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. -annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_image", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = Although unlikely, some legitimate third party applications may use a moved copy of dllhost, triggering a false positive. providing_technologies = [] @@ -2443,7 +2463,7 @@ asset_type = confidence = medium explanation = this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used. -annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} known_false_positives = admin nslookup usage providing_technologies = [] @@ -2459,7 +2479,7 @@ This search produces fields (`query`,`query_length`,`count`) that are not yet su 1. \ 1. **Label:** Number of events, **Field:** count\ Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` -annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} known_false_positives = If you are seeing more results than desired, you may consider reducing the value for threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data. providing_technologies = [] @@ -2469,7 +2489,7 @@ asset_type = Endpoint confidence = medium explanation = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. -annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}, {"name": "query", "role": ["Attacker"], "type": "dnsquery"}]} +annotations = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} known_false_positives = It's possible there can be long domain names that are legitimate. providing_technologies = [] @@ -2479,7 +2499,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework. how_to_implement = To successfully implement this search you will need to ensure that DNS data is populating the Network_Resolution data model. It also requires that your DNS servers are identified correctly in the Assets and Identity table of Enterprise Security. -annotations = {"analytic_story": ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} +annotations = {"cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} known_false_positives = Legitimate DNS activity can be detected in this search. Investigate, verify and update the list of authorized DNS servers as appropriate. providing_technologies = [] @@ -2493,7 +2513,7 @@ how_to_implement = To successfully implement this search you will need to ensure If Splunk>Phantom is also configured in your environment, a Playbook called "DNS Hijack Enrichment" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. \ (Playbook Link:`https://my.phantom.us/4.2/playbook/dns-hijack-enrichment/`).\ -annotations = {"analytic_story": ["DNS Hijacking"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} +annotations = {"cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} known_false_positives = Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate. providing_technologies = [] @@ -2508,7 +2528,7 @@ DSQuery.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64` The following DLL(s) are loaded when DSQuery.exe is launched `dsquery.dll`. If found loaded by another process, it is possible dsquery is running within that process context in memory.\ In addition to trust discovery, review parallel processes for additional behaviors performed. Identify the parent process and capture any files (batch files, for example) being used. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Domain Trust Discovery", "Active Directory Discovery"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"]} known_false_positives = Limited false positives. If there is a true false positive, filter based on command-line or parent process. providing_technologies = [] @@ -2518,7 +2538,7 @@ asset_type = confidence = medium explanation = This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. -annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = unknown providing_technologies = [] @@ -2528,7 +2548,7 @@ asset_type = confidence = medium explanation = This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["XMRig"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]} known_false_positives = System administrators or scripts may delete user accounts via this technique. Filter as needed. providing_technologies = [] @@ -2538,7 +2558,7 @@ asset_type = Endpoint confidence = medium explanation = The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8", "CIS 10"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} known_false_positives = vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare. providing_technologies = [] @@ -2554,7 +2574,7 @@ This search produces fields (`eventName`,`userIdentity.type`,`userIdentity.arn`) 1. \ 1. **Label:** AWS User Type, **Field:** userIdentity.type\ Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` -annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "nist": ["DE.DP", "PR.AC"]} +annotations = {"cis20": ["CIS 16"], "nist": ["DE.DP", "PR.AC"]} known_false_positives = Many service accounts configured within an AWS infrastructure do not have multi factor authentication enabled. Please ignore the service accounts, if triggered and instead add them to the aws_service_accounts.csv file to fine tune the detection. It is also possible that the search detects users in your environment using Single Sign-On systems, since the MFA is not handled by AWS. providing_technologies = [] @@ -2564,7 +2584,7 @@ asset_type = Infrastructure confidence = medium explanation = By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure. how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and Dynamic ARP Inspection (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/security/configuration_guide/b_sec_1522e_2960x_cg/b_sec_1522e_2960x_cg_chapter_01111.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices. -annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = This search might be prone to high false positives if DHCP Snooping or ARP inspection has been incorrectly configured, or if a device normally sends many ARP packets (unlikely). providing_technologies = [] @@ -2580,7 +2600,7 @@ This search produces fields (`eventName`,`firstTime`,`lastTime`) that are not ye 1. \ 1. **Label:** Last Time, **Field:** lastTime\ Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` -annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC", "ID.AM"]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC", "ID.AM"]} known_false_positives = It's likely that you'll find activity detected by users/service accounts that are not listed in the `identity_lookup_expanded` or ` aws_service_accounts.csv` file. If the user is a legitimate service account, update the `aws_service_accounts.csv` table with that entry. providing_technologies = [] @@ -2590,7 +2610,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. -annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2600,7 +2620,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. -annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2610,7 +2630,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. -annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2620,7 +2640,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. -annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -2630,7 +2650,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. how_to_implement = To successfully implement this search, you must ingest your Windows Security Event logs and leverage the latest TA for Windows. -annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550", "T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} known_false_positives = Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate. providing_technologies = [] @@ -2640,7 +2660,7 @@ asset_type = confidence = medium explanation = The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]} known_false_positives = Unknown. providing_technologies = [] @@ -2650,7 +2670,7 @@ asset_type = confidence = medium explanation = The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]} known_false_positives = False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. providing_technologies = [] @@ -2660,7 +2680,7 @@ asset_type = Endpoint confidence = medium explanation = This search detects the heap-based buffer overflow of sudoedit how_to_implement = Splunk Universal Forwarder running on Linux systems, capturing logs from the /var/log directory. The vulnerability is exposed when a non privledged user tries passing in a single \ character at the end of the command while using the shell and edit flags. -annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2670,7 +2690,7 @@ asset_type = Endpoint confidence = medium explanation = This search detects the heap-based buffer overflow of sudoedit how_to_implement = Splunk Universal Forwarder running on Linux systems (tested on Centos and Ubuntu), where segfaults are being logged. This also captures instances where the exploit has been compiled into a binary. The detection looks for greater than 5 instances of sudoedit combined with segfault over your search time period on a single host -annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} known_false_positives = If sudoedit is throwing segfaults for other reasons this will pick those up too. providing_technologies = [] @@ -2680,7 +2700,7 @@ asset_type = Endpoint confidence = medium explanation = This search detects the heap-based buffer overflow of sudoedit how_to_implement = OSQuery installed and configured to pick up process events (info at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402. The vulnerability is exposed when a non privledged user tries passing in a single \ character at the end of the command while using the shell and edit flags. -annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2690,7 +2710,7 @@ asset_type = Windows confidence = medium explanation = This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An account was successfully logged on) with an anonymous account. how_to_implement = This search requires audit computer account management to be enabled on the system in order to generate Event ID 4742. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Event Logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 6", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} +annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"]} known_false_positives = None thus far found providing_technologies = [] @@ -2702,7 +2722,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]} known_false_positives = Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives. providing_technologies = [] @@ -2712,7 +2732,7 @@ asset_type = Windows confidence = medium explanation = This search looks for reading lsass memory consistent with credential dumping. how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"], "observable": [{"name": "source_image", "role": ["Victim"], "type": "Other"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetImage", "role": ["Victim"], "type": "Other"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} known_false_positives = The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise. providing_technologies = [] @@ -2726,7 +2746,7 @@ how_to_implement = You need to ingest data from your DNS logs in the Network_Res If Splunk>Phantom is also configured in your environment, a Playbook called `Lets Encrypt Domain Investigate` can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. \ (Playbook link:`https://my.phantom.us/4.2/playbook/lets-encrypt-domain-investigate/`).\ -annotations = {"analytic_story": ["Common Phishing Frameworks"], "cis20": ["CIS 8", "CIS 7"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1566.003"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 7"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1566.003"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} known_false_positives = If a known good domain is not listed in the legit_domains.csv file, then the search could give you false postives. Please update that lookup file to filter out DNS requests to legitimate domains. providing_technologies = [] @@ -2738,7 +2758,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} known_false_positives = False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern. providing_technologies = [] @@ -2752,7 +2772,7 @@ how_to_implement = You must ingest your Windows security event logs in the `Chan If Splunk>Phantom is also configured in your environment, a Playbook called "Excessive Account Lockouts Enrichment and Response" can be configured to run when any results are found by this detection search. The Playbook executes the Contextual and Investigative searches in this Story, conducts additional information gathering on Windows endpoints, and takes a response action to shut down the affected endpoint. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. \ (Playbook Link:`https://my.phantom.us/4.1/playbook/excessive-account-lockouts-enrichment-and-response/`).\ -annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078.002"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["PR.IP"]} known_false_positives = It's possible that a widely used system, such as a kiosk, could cause a large number of account lockouts. providing_technologies = [] @@ -2762,7 +2782,7 @@ asset_type = Windows confidence = medium explanation = This search detects user accounts that have been locked out a relatively high number of times in a short period. how_to_implement = ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. -annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078.003"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "result", "role": ["Victim"], "type": "Other"}]} +annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.003"], "nist": ["PR.IP"]} known_false_positives = It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts. providing_technologies = [] @@ -2770,9 +2790,9 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. +explanation = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. -annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exploitation"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"]} known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. providing_technologies = [] @@ -2782,7 +2802,7 @@ asset_type = Network confidence = medium explanation = This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traffix SDC devices how_to_implement = To consistently detect exploit attempts on F5 devices using the vulnerabilities contained within CVE-2020-5902 it is recommended to ingest logs via syslog. As many BIG-IP devices will have SSL enabled on their management interfaces, detections via wire data may not pick anything up unless you are decrypting SSL traffic in order to inspect it. I am using a regex string from a Cloudflare mitigation technique to try and always catch the offending string (..;), along with the other exploit of using (hsqldb;). -annotations = {"analytic_story": ["F5 TMUI RCE CVE-2020-5902"], "cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2792,7 +2812,7 @@ asset_type = GCP Storage Bucket confidence = medium explanation = This search looks at GCP Storage bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed a GCP Storage bucket. how_to_implement = This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview). In order to capture public GCP Storage Bucket access logs, you must also enable storage bucket logging to your PubSub Topic as per https://cloud.google.com/storage/docs/access-logs. These logs are deposited into the nominated Storage Bucket on an hourly basis and typically show up by 15 minutes past the hour. It is recommended to configure any saved searches or correlation searches in Enterprise Security to run on an hourly basis at 30 minutes past the hour (cron definition of 30 * * * *). A lookup table (previously_seen_gcp_storage_access_from_remote_ip.csv) stores the previously seen access requests, and is used by this search to determine any newly seen IP addresses accessing the Storage Buckets. -annotations = {"analytic_story": ["Suspicious GCP Storage Activities"], "cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +annotations = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow it), as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past two hours. providing_technologies = [] @@ -2802,7 +2822,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed. providing_technologies = [] @@ -2812,7 +2832,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review child process events and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed. providing_technologies = [] @@ -2822,7 +2842,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed. providing_technologies = [] @@ -2832,7 +2852,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm file from within a CHM file. CHM files may contain nearly any file type embedded. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It is rare to see instances of InfoTech Storage Handlers being used, but it does happen in some legitimate instances. Filter as needed. providing_technologies = [] @@ -2842,7 +2862,7 @@ asset_type = Infrastructure confidence = medium explanation = By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's network devices, we will be able to detect various attacks such as packet forging in the Infrastructure. how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with one or more First Hop Security measures such as RA Guard, DHCP Guard and/or device tracking. See References for more information. The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices. -annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = None currently known providing_technologies = [] @@ -2852,7 +2872,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for outbound ICMP packets with a packet size larger than 1,000 bytes. Various threat actors have been known to use ICMP as a command and control channel for their attack infrastructure. Large ICMP packets from an endpoint to a remote host may be indicative of this activity. how_to_implement = In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have a good understanding of how your network segments are designed and that you are able to distinguish internal from external address space. Add a category named `internal` to the CIDRs that host the company's assets in the `assets_by_cidr.csv` lookup file, which is located in `$SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/`. More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. This search also requires you to be ingesting your network traffic and populating the Network_Traffic data model -annotations = {"analytic_story": ["Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1095"], "nist": ["DE.AE"]} +annotations = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1095"], "nist": ["DE.AE"]} known_false_positives = ICMP packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. As such, it is possible that a large ICMP packet could be perfectly legitimate. If large ICMP packets are associated with command and control traffic, there will typically be a large number of these packets observed over time. If the search is providing a large number of false positives, you can modify the macro `detect_large_outbound_icmp_packets_filter` to adjust the byte threshold or add specific IP addresses to an allow list. providing_technologies = [] @@ -2862,7 +2882,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. Deprecated because this detection should focus on DNS queries instead of DNS responses. how_to_implement = To successfully implement this search you need to ingest data from your DNS logs, or monitor DNS traffic using Stream, Bro or something similar. Specifically, this query requires that the DNS data model is populated with information regarding the DNS record type that is being returned as well as the data in the answer section of the protocol. -annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} known_false_positives = It's possible that legitimate TXT record responses can be long enough to trigger this search. You can modify the packet threshold for this search to help mitigate false positives. providing_technologies = [] @@ -2872,7 +2892,7 @@ asset_type = Endpoint confidence = medium explanation = This analytic identifies when Microsoft HTML Application Host (mshta.exe) utility is used to make remote http connections. Adversaries may use mshta.exe to proxy the download and execution of remote .hta files. The analytic identifies command line arguments of http and https being used. This technique is commonly used by malicious software to bypass preventative controls. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It is possible legitimate applications may perform this behavior and will need to be filtered. providing_technologies = [] @@ -2882,7 +2902,7 @@ asset_type = Windows confidence = medium explanation = This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Parent Process"}, {"name": "Image", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"]} known_false_positives = Other tools can import the same DLLs. These tools should be part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process. providing_technologies = [] @@ -2892,7 +2912,7 @@ asset_type = Windows confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for PowerShell requesting privileges consistent with credential dumping. Deprecated, looks like things changed from a logging perspective. how_to_implement = You must be ingesting Windows Security logs. You must also enable the account change auditing here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/MonitorWindowseventlogdata. Additionally, this search requires you to enable your Group Management Audit Logs in your Local Windows Security Policy and to be ingesting those logs. More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/. Finally, please make sure that the local administrator group name is "Administrators" to be able to look for the right group membership changes. -annotations = {"analytic_story": ["Cloud Federated Credential Abuse"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} known_false_positives = The activity may be legitimate. PowerShell is often used by administrators to perform various tasks, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise. providing_technologies = [] @@ -2904,7 +2924,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"]} known_false_positives = False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed. providing_technologies = [] @@ -2914,7 +2934,7 @@ asset_type = Windows confidence = medium explanation = This search looks for newly created accounts that have been elevated to local administrators. how_to_implement = You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 -annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.AC", "DE.CM"]} known_false_positives = The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives providing_technologies = [] @@ -2924,7 +2944,7 @@ asset_type = Endpoint confidence = medium explanation = The search queries the authentication logs for assets that are categorized as routers in the ES Assets and Identity Framework, to identify connections that have not been seen before in the last 30 days. how_to_implement = To successfully implement this search, you must ensure the network router devices are categorized as "router" in the Assets and identity table. You must also populate the Authentication data model with logs related to users authenticating to routing infrastructure. -annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "PR.AC", "PR.IP"]} +annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "PR.AC", "PR.IP"]} known_false_positives = Legitimate router connections may appear as new connections providing_technologies = [] @@ -2934,7 +2954,7 @@ asset_type = GCP Storage Bucket confidence = medium explanation = This search looks for GCP PubSub events where a user has created an open/public GCP Storage bucket. how_to_implement = This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview). -annotations = {"analytic_story": ["Suspicious GCP Storage Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that a GCP admin has legitimately created a public bucket for a specific purpose. That said, GCP strongly advises against granting full control to the "allUsers" group. providing_technologies = [] @@ -2944,7 +2964,7 @@ asset_type = S3 Bucket confidence = medium explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. how_to_implement = -annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userIdentity.userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. providing_technologies = [] @@ -2954,7 +2974,7 @@ asset_type = S3 Bucket confidence = medium explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. how_to_implement = You must install the AWS App for Splunk. -annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. providing_technologies = [] @@ -2964,7 +2984,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for outbound SMB connections made by hosts within your network to the Internet. SMB traffic is used for Windows file-sharing activity. One of the techniques often used by attackers involves retrieving the credential hash using an SMB request made to a compromised server controlled by the threat actor. how_to_implement = In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have good understanding of how your network segments are designed, and be able to distinguish internal from external address space. Add a category named `internal` to the CIDRs that host the companys assets in `assets_by_cidr.csv` lookup file, which is located in `$SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/`. More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. This search also requires you to be ingesting your network traffic and populating the Network_Traffic data model -annotations = {"analytic_story": ["Hidden Cobra Malware", "DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.002"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.002", "T1071"], "nist": ["DE.CM"]} known_false_positives = It is likely that the outbound Server Message Block (SMB) traffic is legitimate, if the company's internal networks are not well-defined in the Assets and Identity Framework. Categorize the internal CIDR blocks as `internal` in the lookup file to avoid creating notable events for traffic destined to those CIDR blocks. Any other network connection that is going out to the Internet should be investigated and blocked. Best practices suggest preventing external communications of all SMB versions and related protocols at the network boundary. providing_technologies = [] @@ -2974,7 +2994,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk. how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. -annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.001"], "nist": ["ID.AM", "PR.DS"]} +annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = It is not uncommon for outlook to write legitimate zip files to the disk. providing_technologies = [] @@ -2984,7 +3004,7 @@ asset_type = Endpoint confidence = medium explanation = The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009", "T1574"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -2994,7 +3014,7 @@ asset_type = Infrastructure confidence = medium explanation = By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs. how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with Port Security and Error Disable for this to work (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices. -annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Exploitation", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Exploitation", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = This search might be prone to high false positives if you have malfunctioning devices connected to your ethernet ports or if end users periodically connect physical devices to the network. providing_technologies = [] @@ -3004,7 +3024,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. how_to_implement = You must be ingesting data that records process activity from your hosts and populates the Endpoint data model with the resultant dataset. This search includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list of processes that should not be spawning cmd.exe. You can modify this lookup to better suit your environment. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. Investigate and modify the lookup file, as appropriate. providing_technologies = [] @@ -3014,7 +3034,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument `accepteula` within the command line. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021", "T1021.002"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine providing_technologies = [] @@ -3024,7 +3044,7 @@ asset_type = confidence = medium explanation = This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} known_false_positives = There is potential for false positives as these arguments may be used by other applications. Filter or tune the analytic as needed. providing_technologies = [] @@ -3034,7 +3054,7 @@ asset_type = Endpoint confidence = medium explanation = This search will return a table of rare processes, the names of the systems running them, and the users who initiated each process. how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts and populating the endpoint data model with the resultant dataset. The macro `filter_rare_process_allow_list` searches two lookup files for allowed processes. These consist of `rare_process_allow_list_default.csv` and `rare_process_allow_list_local.csv`. To add your own processes to the allow list, add them to `rare_process_allow_list_local.csv`. If you wish to remove an entry from the default lookup file, you will have to modify the macro itself to set the allow_list value for that process to false. You can modify the limit parameter and search scheduling to better suit your environment. -annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Unusual Processes", "Cloud Federated Credential Abuse"], "cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.PT", "PR.DS", "DE.CM"]} +annotations = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.PT", "PR.DS", "DE.CM"]} known_false_positives = Some legitimate processes may be only rarely executed in your environment. As these are identified, update `rare_process_allow_list_local.csv` to filter them out of your search results. providing_technologies = [] @@ -3044,7 +3064,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. providing_technologies = [] @@ -3054,7 +3074,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. providing_technologies = [] @@ -3064,7 +3084,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. providing_technologies = [] @@ -3074,7 +3094,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. providing_technologies = [] @@ -3084,7 +3104,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. providing_technologies = [] @@ -3094,7 +3114,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. providing_technologies = [] @@ -3105,7 +3125,7 @@ confidence = medium explanation = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is often referred to as a "Squiblydoo" attack. \ Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Cobalt Strike"], "cis20": ["CIS 8", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"]} known_false_positives = Limited false positives related to third party software registering .DLL's. providing_technologies = [] @@ -3115,7 +3135,7 @@ asset_type = confidence = medium explanation = The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. During triage, validate this is the legitimate version of `7zip` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001", "T1560"]} known_false_positives = Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used. providing_technologies = [] @@ -3125,7 +3145,7 @@ asset_type = confidence = medium explanation = The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. During triage, validate this is the legitimate version of `PsExec` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569", "T1569.002"]} known_false_positives = Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed. providing_technologies = [] @@ -3135,7 +3155,7 @@ asset_type = confidence = medium explanation = The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from the legitimate site and executed accordingly. During triage, isolate the endpoint and begin to review parallel processes for additional behavior. At this stage, the adversary may have staged data to be exfiltrated. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} known_false_positives = False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case. providing_technologies = [] @@ -3145,7 +3165,7 @@ asset_type = confidence = medium explanation = The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001", "T1560"]} known_false_positives = Unknown. It is possible third party applications use renamed instances of WinRAR. providing_technologies = [] @@ -3155,7 +3175,7 @@ asset_type = Infrastructure confidence = medium explanation = By enabling DHCP Snooping as a Layer 2 Security measure on the organization's network devices, we will be able to detect unauthorized DHCP servers handing out DHCP leases to devices on the network (Man in the Middle attack). how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping enabled (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices. -annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557"], "nist": ["ID.AM", "PR.DS"]} +annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = This search might be prone to high false positives if DHCP Snooping has been incorrectly configured or in the unlikely event that the DHCP server has been moved to another network interface. providing_technologies = [] @@ -3165,7 +3185,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may use advpack.dll or ieadvpack.dll, triggering a false positive. providing_technologies = [] @@ -3175,7 +3195,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may use setupapi triggering a false positive. providing_technologies = [] @@ -3185,7 +3205,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may use syssetup.dll, triggering a false positive. providing_technologies = [] @@ -3195,7 +3215,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies "rundll32.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. This type of behavior is commonly observed with fileless malware or application whitelisting bypass techniques. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive. providing_technologies = [] @@ -3205,7 +3225,7 @@ asset_type = S3 Bucket confidence = medium explanation = This search looks at S3 bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed an S3 bucket. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access logs' inputs. This search works best when you run the "Previously Seen S3 Bucket Access by Remote IP" support search once to create a history of previously seen remote IPs and bucket names. -annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +annotations = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = S3 buckets can be accessed from any IP, as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past hour providing_technologies = [] @@ -3215,7 +3235,7 @@ asset_type = Network confidence = medium explanation = This search looks for commands that the SNICat tool uses in the TLS SNI field. how_to_implement = You must be ingesting Zeek SSL data into Splunk. Zeek data should also be getting ingested in JSON format. We are detecting when any of the predefined SNICat commands are found within the server_name (SNI) field. These commands are LIST, LS, SIZE, LD, CB, EX, ALIVE, EXIT, WHERE, and finito. You can go further once this has been detected, and run other searches to decode the SNI data to prove or disprove if any data exfiltration has taken place. -annotations = {"analytic_story": ["Data Exfiltration"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1041"], "nist": ["PR.DS", "DE.CM", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1041"], "nist": ["PR.DS", "DE.CM", "DE.AE"]} known_false_positives = Unknown providing_technologies = [] @@ -3225,7 +3245,7 @@ asset_type = confidence = medium explanation = The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]} known_false_positives = False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed. providing_technologies = [] @@ -3235,7 +3255,7 @@ asset_type = confidence = medium explanation = SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]} known_false_positives = False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. providing_technologies = [] @@ -3245,7 +3265,7 @@ asset_type = confidence = medium explanation = The following analytic identifies SharpHound binary usage by using the original filena,e. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic looks for the original_file_name of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]} known_false_positives = False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed. providing_technologies = [] @@ -3255,7 +3275,7 @@ asset_type = Infrastructure confidence = medium explanation = Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. how_to_implement = This search looks for Network Traffic events to TFTP, FTP or SSH/SCP ports from network devices. Make sure to tag any network devices as network, router or switch in order for this detection to work. If the TFTP traffic doesn't traverse a firewall nor packet inspection, these events will not be logged. This is typically an issue if the TFTP server is on the same subnet as the network device. There is also a chance of the network device loading software using a DHCP assigned IP address (netboot) which is not in the Asset inventory. -annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1542.005"], "nist": ["ID.AM", "PR.DS"]} +annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1542.005", "T1542"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = This search will also report any legitimate attempts of software downloads to network devices as well as outbound SSH sessions from network devices. providing_technologies = [] @@ -3271,7 +3291,7 @@ This search produces fields (`eventName`,`numberOfApiCalls`,`uniqueApisCalled`) 1. \ 1. **Label:** Unique API Calls, **Field:** uniqueApisCalled\ Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` -annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = providing_technologies = [] @@ -3281,7 +3301,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. -annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} known_false_positives = None providing_technologies = [] @@ -3291,7 +3311,7 @@ asset_type = AWS Instance confidence = medium explanation = This search looks for a spike in number of of AWS security Hub alerts for an AWS IAM User in 4 hours intervals. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. -annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = None providing_technologies = [] @@ -3301,7 +3321,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Network ACL Activity by ARN" support search once to create a lookup file of previously seen Network ACL Activity. To add or remove API event names related to network ACLs, edit the macro `network_acl_events`. -annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 12", "CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +annotations = {"cis20": ["CIS 12", "CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Please modify this according the your environment. providing_technologies = [] @@ -3311,7 +3331,7 @@ asset_type = S3 Bucket confidence = medium explanation = This search detects users creating spikes in API activity related to deletion of S3 buckets in your AWS environment. It will also update the cache file that factors in the latest data. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity. -annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment. providing_technologies = [] @@ -3321,7 +3341,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.This search works best when you run the "Baseline of Security Group Activity by ARN" support search once to create a history of previously seen Security Group Activity. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. -annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} known_false_positives = Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment. providing_technologies = [] @@ -3331,7 +3351,7 @@ asset_type = AWS Instance confidence = medium explanation = This search will detect spike in blocked outbound network connections originating from within your AWS environment. It will also update the cache file that factors in the latest data. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your VPC Flow logs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the number of data points required to meet the definition of "spike." The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Blocked Outbound Connection" support search once to create a history of previously seen blocked outbound connections. -annotations = {"analytic_story": ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]} +annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]} known_false_positives = The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Additionally, false positives may result when AWS administrators roll out policies enforcing network blocks, causing sudden increases in the number of blocked outbound connections. providing_technologies = [] @@ -3341,7 +3361,7 @@ asset_type = Infrastructure confidence = medium explanation = Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices and that the devices have been configured according to the documentation of the Cisco Networks Add-on. Also note that an attacker may disable logging from the device prior to enabling traffic mirroring. -annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1020.001"], "nist": ["ID.AM", "PR.DS"]} +annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1020", "T1498", "T1020.001"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = This search will return false positives for any legitimate traffic captures by network administrators. providing_technologies = [] @@ -3351,7 +3371,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search is used to detect hosts that generate Windows Event ID 4663 for successful attempts to write to or read from a removable storage and Event ID 4656 for failures, which occurs when a USB drive is plugged in. In this scenario we are querying the Change_Analysis data model to look for Windows Event ID 4656 or 4663 where the priority of the affected host is marked as high in the ES Assets and Identity Framework. how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663 and 4656. Ensure that the field from the event logs is being mapped to the result_id field in the Change_Analysis data model. To minimize the alert volume, this search leverages the Assets and Identity framework to filter out events from those assets not marked high priority in the Enterprise Security Assets and Identity Framework. -annotations = {"analytic_story": ["Data Protection"], "cis20": ["CIS 13"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "nist": ["PR.PT", "PR.DS"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "nist": ["PR.PT", "PR.DS"]} known_false_positives = Legitimate USB activity will also be detected. Please verify and investigate as appropriate. providing_technologies = [] @@ -3361,7 +3381,7 @@ asset_type = Infrastructure confidence = medium explanation = By populating the organization's assets within the assets_by_str.csv, we will be able to detect unauthorized devices that are trying to connect with the organization's network by inspecting DHCP request packets, which are issued by devices when they attempt to obtain an IP address from the DHCP server. The MAC address associated with the source of the DHCP request is checked against the list of known devices, and reports on those that are not found. how_to_implement = This search uses the Network_Sessions data model shipped with Enterprise Security. It leverages the Assets and Identity framework to populate the assets_by_str.csv file located in SA-IdentityManagement, which will contain a list of known authorized organizational assets including their MAC addresses. Ensure that all inventoried systems have their MAC address populated. -annotations = {"analytic_story": ["Asset Tracking"], "cis20": ["CIS 1"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} +annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = This search might be prone to high false positives. Please consider this when conducting analysis or investigations. Authorized devices may be detected as unauthorized. If this is the case, verify the MAC address of the system responsible for the false positive and add it to the Assets and Identity framework with the proper information. providing_technologies = [] @@ -3371,7 +3391,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for the execution of the cscript.exe or wscript.exe processes, with a parent of cmd.exe. The search will return the count, the first and last time this execution was seen on a machine, the user, and the destination of the machine how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Some legitimate applications may exhibit this behavior. providing_technologies = [] @@ -3386,7 +3406,7 @@ All event subscriptions have three components \ 1. Binding - Registers a filter to a consumer. EventID equals 21 \ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. how_to_implement = To successfully implement this search, you need to be ingesting logs with that provide WMI Event Subscription from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume. -annotations = {"analytic_story": ["Suspicious WMI Use"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003", "T1546"]} known_false_positives = It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin's for further depth of coverage. providing_technologies = [] @@ -3396,7 +3416,7 @@ asset_type = Endpoint confidence = medium explanation = This search detects SIGRed via Splunk Stream. how_to_implement = You must be ingesting Splunk Stream DNS and Splunk Stream TCP. We are detecting SIG and KEY records via stream:dns and TCP payload over 65KB in size via stream:tcp. Replace the macro definitions ('stream:dns' and 'stream:tcp') with configurations for your Splunk environment. -annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -3406,7 +3426,7 @@ asset_type = Endpoint confidence = medium explanation = This search detects SIGRed via Zeek DNS and Zeek Conn data. how_to_implement = You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should also be getting ingested in JSON format. We are detecting SIG and KEY records via bro:dns:json and TCP payload over 65KB in size via bro:conn:json. The Network Resolution and Network Traffic datamodels are in use for this search. -annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -3416,7 +3436,7 @@ asset_type = Network confidence = medium explanation = This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC how_to_implement = You must be ingesting Zeek DCE-RPC data into Splunk. Zeek data should also be getting ingested in JSON format. We are detecting when all three RPC operations (NetrServerReqChallenge, NetrServerAuthenticate3, NetrServerPasswordSet2) are splunk_security_essentials_app via bro:rpc:json. These three operations are then correlated on the Zeek UID field. -annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -3426,7 +3446,7 @@ asset_type = Web Server confidence = medium explanation = This search looks for specific GET or HEAD requests to web servers that are indicative of reconnaissance attempts to identify vulnerable JBoss servers. JexBoss is described as the exploit tool of choice for this malicious activity. how_to_implement = You must be ingesting data from the web server or network traffic that contains web specific information, and populating the Web data model. -annotations = {"analytic_story": ["JBoss Vulnerability", "SamSam Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1082"]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1082"]} known_false_positives = It's possible for legitimate HTTP requests to be made to URLs containing the suspicious paths. providing_technologies = [] @@ -3442,7 +3462,7 @@ This search produces fields (query, answer, isDynDNS) that are not yet supported 1. \ 1. **Label:** IsDynamicDNS, **Field:** isDynDNS\ Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` -annotations = {"analytic_story": ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "confidence": 80, "context": ["source:endpoint", {"stage": "Initial Access"}], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1189"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}, {"name": "query", "role": ["Attacker"], "type": "dnsquery"}]} +annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1189"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} known_false_positives = Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified. providing_technologies = [] @@ -3452,7 +3472,7 @@ asset_type = Web Server confidence = medium explanation = This search is used to detect malicious HTTP requests crafted to exploit jmx-console in JBoss servers. The malicious requests have a long URL length, as the payload is embedded in the URL. how_to_implement = You must ingest data from the web server or capture network data that contains web specific information with solutions such as Bro or Splunk Stream, and populating the Web data model -annotations = {"analytic_story": ["JBoss Vulnerability", "SamSam Ransomware"], "cis20": ["CIS 12", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]} +annotations = {"cis20": ["CIS 12", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]} known_false_positives = No known false positives for this detection. providing_technologies = [] @@ -3462,7 +3482,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies "mshta.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive. providing_technologies = [] @@ -3472,7 +3492,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This analytic utilizes the internal name of the PE to identify if is the legitimate mshta binary. Further analysis should be performed to review the executed content and validation it is the real mshta. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may use a moved copy of mshta.exe, but never renamed, triggering a false positive. providing_technologies = [] @@ -3482,7 +3502,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously seen API call per user roles in AWS CloudTrail" support search once to create a history of previously seen user roles. -annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} known_false_positives = It is possible that there are legitimate user roles making new or infrequently used API calls in your infrastructure, causing the search to trigger. providing_technologies = [] @@ -3492,7 +3512,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. -annotations = {"analytic_story": ["Suspicious AWS Login Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. providing_technologies = [] @@ -3502,7 +3522,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for fast execution of processes used for system network configuration discovery on the endpoint. how_to_implement = You must be ingesting data that records registry activity from your hosts to populate the Endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or that are populated via Windows event logs, after enabling process tracking in your Windows audit settings. -annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 40, "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives. providing_technologies = [] @@ -3512,7 +3532,7 @@ asset_type = EC2 Snapshot confidence = medium explanation = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -annotations = {"analytic_story": ["Suspicious Cloud Instance Activities", "Data Exfiltration"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Exfiltration"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose. providing_technologies = [] @@ -3524,7 +3544,7 @@ explanation = WARNING, this detection has been marked deprecated by the Splunk T how_to_implement = This search requires you to be ingesting web-traffic logs. You can obtain these logs from indexing data from a web proxy or by using a network-traffic-analysis tool, such as Bro or Splunk Stream. The web data model must contain the URL being requested, the IP address of the host initiating the request, and the destination IP. This search also leverages a lookup file, `dynamic_dns_providers_default.csv`, which contains a non-exhaustive list of dynamic DNS providers. Consider periodically updating this local lookup file with new domains.\ This search produces fields (`isDynDNS`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** IsDynamicDNS, **Field:** isDynDNS\ Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` Deprecated because duplicate. -annotations = {"analytic_story": ["Dynamic DNS"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.001"], "nist": ["PR.IP", "DE.DP"]} +annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.001"], "nist": ["PR.IP", "DE.DP"]} known_false_positives = It is possible that list of dynamic DNS providers is outdated and/or that the URL being requested is legitimate. providing_technologies = [] @@ -3534,7 +3554,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic. Deprecated because existing detection is doing the same. how_to_implement = To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the Network_Resolution data model. Fields like src_category are automatically provided by the Assets and Identity Framework shipped with Splunk Enterprise Security. You will need to ensure you are using the Assets and Identity Framework and populating the src_category field. You will also need to enable the `cim_corporate_web_domain_search()` macro which will essentially filter out the DNS queries made to the corporate web domains to reduce alert fatigue. -annotations = {"analytic_story": ["Data Protection", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]} known_false_positives = It's possible that normal DNS traffic will exhibit this behavior. If an alert is generated, please investigate and validate as appropriate. The threshold can also be modified to better suit your environment. providing_technologies = [] @@ -3544,7 +3564,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for specific command-line arguments that may indicate the execution of tools made by Nirsoft, which are legitimate, but may be abused by attackers. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A "], "cis20": ["CIS 3"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1072"], "nist": ["PR.IP"]} +annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1072"], "nist": ["PR.IP"]} known_false_positives = While legitimate, these NirSoft tools are prone to abuse. You should verfiy that the tool was used for a legitimate purpose. providing_technologies = [] @@ -3554,7 +3574,7 @@ asset_type = confidence = medium explanation = this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = network operator may disable this feature of windows but not so common. providing_technologies = [] @@ -3564,7 +3584,7 @@ asset_type = confidence = medium explanation = this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = network operator may disable this feature of windows but not so common. providing_technologies = [] @@ -3574,7 +3594,7 @@ asset_type = confidence = medium explanation = This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070", "T1070.001"]} known_false_positives = network operator may disable audit event logs for debugging purposes. providing_technologies = [] @@ -3584,27 +3604,47 @@ asset_type = confidence = medium explanation = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin may disable this application for non technical user. providing_technologies = [] +[savedsearch://ESCU - Disable Security Logs Using MiniNt Registry - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} +known_false_positives = Unknown. +providing_technologies = [] + [savedsearch://ESCU - Disable Show Hidden Files - Rule] type = detection asset_type = confidence = medium explanation = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001", "T1564", "T1562"]} known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Disable UAC Remote Restriction - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} +known_false_positives = admin may set this policy for non-critical machine. +providing_technologies = [] + [savedsearch://ESCU - Disable Windows App Hotkeys - Rule] type = detection asset_type = confidence = medium explanation = This analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. This technique is used to impair the analyst in analyzing and removing the attacker implant in compromised systems. how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = unknown providing_technologies = [] @@ -3614,7 +3654,7 @@ asset_type = confidence = medium explanation = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin or user may choose to disable this windows features. providing_technologies = [] @@ -3624,7 +3664,7 @@ asset_type = confidence = medium explanation = The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin or user may choose to disable this windows features. providing_technologies = [] @@ -3634,7 +3674,7 @@ asset_type = confidence = medium explanation = this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin may disable this application for non technical user. providing_technologies = [] @@ -3644,7 +3684,7 @@ asset_type = confidence = medium explanation = this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin may disable this application for non technical user. providing_technologies = [] @@ -3654,7 +3694,7 @@ asset_type = confidence = medium explanation = This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin may disable firewall during testing or fixing network problem. providing_technologies = [] @@ -3664,7 +3704,7 @@ asset_type = confidence = medium explanation = This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin may disable this application for non technical user. providing_technologies = [] @@ -3674,7 +3714,7 @@ asset_type = confidence = medium explanation = This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious act. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["XMRig"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]} known_false_positives = unknown providing_technologies = [] @@ -3684,7 +3724,7 @@ asset_type = confidence = medium explanation = This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin may disable this application for non technical user. providing_technologies = [] @@ -3694,7 +3734,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Remcos"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002", "T1548"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. providing_technologies = [] @@ -3704,7 +3744,7 @@ asset_type = confidence = medium explanation = The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep their infection on the box. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = in some cases admin can disable systemrestore on a machine. providing_technologies = [] @@ -3714,7 +3754,7 @@ asset_type = confidence = medium explanation = This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = admin may disable this application for non technical user. providing_technologies = [] @@ -3724,7 +3764,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -3734,7 +3774,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover domain users. The `user` argument returns a list of all users registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -3744,7 +3784,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -3754,7 +3794,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `nltest.exe` with command-line arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', can be used to return a list of all domain controllers. Red Teams and adversaries alike may use nltest.exe to identify domain controllers in a Windows Domain for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -3764,7 +3804,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command line return a list of all domain controllers in a Windows domain. Red Teams and adversaries alike use *.exe to identify remote systems for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -3774,7 +3814,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -3784,7 +3824,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `net.exe` with command-line arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -3794,7 +3834,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. Red Teams and adversaries alike use wmic.exe to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -3804,7 +3844,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use Adsisearcher for troubleshooting. providing_technologies = [] @@ -3814,7 +3854,7 @@ asset_type = confidence = medium explanation = The following analytic will identify a suspicious download by the Telegram application on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with downloading different network scanners (port, bruteforcer, masscan) to the system and later used to mapped the whole network and further move laterally. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and TargetFilename from your endpoints or Events that monitor filestream events which is happened when process download something. (EventCode 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} known_false_positives = normal download of file in telegram app. (if it was a common app in network) providing_technologies = [] @@ -3824,7 +3864,7 @@ asset_type = confidence = medium explanation = This search is to detect dropping a suspicious file named as "license.dat" in %appdata%. This behavior seen in latest IcedID malware that contain the actual core bot that will be injected in other process to do banking stealing. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204", "T1204.002"]} known_false_positives = unknown providing_technologies = [] @@ -3834,7 +3874,7 @@ asset_type = Endpoint confidence = medium explanation = Detect the usage of comsvcs.dll for dumping the lsass process. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]} known_false_positives = None identified. providing_technologies = [] @@ -3845,7 +3885,7 @@ confidence = medium explanation = Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This query does not monitor for the internal name (original_file_name=procdump) of the PE or look for procdump64.exe. Modify the query as needed.\ During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]} known_false_positives = None identified. providing_technologies = [] @@ -3856,7 +3896,7 @@ confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. Modify the query as needed.\ During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} known_false_positives = None identified. providing_technologies = [] @@ -3866,7 +3906,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being modified by users who have not previously modified them. This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -annotations = {"analytic_story": ["Unusual AWS EC2 Modifications"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior. providing_technologies = [] @@ -3876,7 +3916,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen AWS Regions" support search only once to create of baseline of previously seen regions. This search is deprecated and have been translated to use the latest Change Datamodel. -annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate. providing_technologies = [] @@ -3886,7 +3926,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 AMIs" support search once to create a history of previously seen AMIs. -annotations = {"analytic_story": ["AWS Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} +annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} known_false_positives = After a new AMI is created, the first systems created with that AMI will cause this alert to fire. Verify that the AMI being used was created by a legitimate user. providing_technologies = [] @@ -3896,7 +3936,7 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Instance Types" support search once to create a history of previously seen instance types. -annotations = {"analytic_story": ["AWS Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} +annotations = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} known_false_positives = It is possible that an admin will create a new system using a new instance type never used before. Verify with the creator that they intended to create the system with the new instance type. providing_technologies = [] @@ -3906,17 +3946,27 @@ asset_type = AWS Instance confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the latest Change Datamodel. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. -annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} +annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} known_false_positives = It's possible that a user will start to create EC2 instances when they haven't before for any number of reasons. Verify with the user that is launching instances that this is the intended behavior. providing_technologies = [] +[savedsearch://ESCU - ETW Registry Disabled - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.006", "T1127", "T1562"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Elevated Group Discovery With Net - Rule] type = detection asset_type = confidence = medium explanation = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -3926,7 +3976,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -3936,7 +3986,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this PowerView for troubleshooting. providing_technologies = [] @@ -3948,7 +3998,7 @@ explanation = Attackers often use spaces as a means to obfuscate an attachment's how_to_implement = You need to ingest data from emails. Specifically, the sender's address and the file names of any attachments must be mapped to the Email data model. The threshold ratio is set to 10%, but this value can be configured to suit each environment. \ **Splunk Phantom Playbook Integration**\ If Splunk Phantom is also configured in your environment, a playbook called "Suspicious Email Attachment Investigate and Delete" can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/` and add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search. The notable event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user's inbox. -annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} +annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} known_false_positives = None at this time providing_technologies = [] @@ -3958,7 +4008,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks at the change-analysis data model and detects email files created outside the normal Outlook directory. how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. -annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.001"]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114", "T1114.001"]} known_false_positives = Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search. providing_technologies = [] @@ -3968,7 +4018,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server. how_to_implement = This search requires you to be ingesting your network traffic and populating the Network_Traffic data model. Your email servers must be categorized as "email_server" for the search to work, as well. You may need to adjust the deviation_threshold and minimum_data_samples values based on the network traffic in your environment. The "deviation_threshold" field is a multiplying factor to control how much variation you're willing to tolerate. The "minimum_data_samples" field is the minimum number of connections of data samples required for the statistic to be valid. -annotations = {"analytic_story": ["Collection and Staging", "HAFNIUM Group"], "cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} +annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114", "T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} known_false_positives = The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers. providing_technologies = [] @@ -3978,7 +4028,17 @@ asset_type = confidence = medium explanation = This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Enable WDigest UseLogonCredential Registry - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112", "T1003"]} known_false_positives = unknown providing_technologies = [] @@ -3988,7 +4048,7 @@ asset_type = confidence = medium explanation = This analytic will detect a suspicious Telegram process enumerating all network users in a local group. This technique was seen in a Monero infected honeypot to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device. how_to_implement = To successfully implement this search, you need to be ingesting logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and filter known instances of process like logonUI used in your environment. -annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"]} known_false_positives = unknown providing_technologies = [] @@ -3998,7 +4058,7 @@ asset_type = confidence = medium explanation = The following analytic identifies the process - `esentutl.exe` - being used to capture credentials stored in ntds.dit or the SAM file on disk. During triage, review parallel processes and determine if legitimate activity. Upon determination of illegitimate activity, take further action to isolate and contain the threat. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Privilege Escalation", "Lateral Movement"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Privilege Escalation", "Lateral Movement"], "mitre_attack": ["T1003.002", "T1003"]} known_false_positives = False positives should be limited. Filter as needed. providing_technologies = [] @@ -4008,7 +4068,7 @@ asset_type = confidence = medium explanation = The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002", "T1548"]} known_false_positives = Some false positives may be present and will need to be filtered. providing_technologies = [] @@ -4018,7 +4078,7 @@ asset_type = confidence = medium explanation = The following detection identifies Microsoft Excel spawning PowerShell. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from Excel.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]} known_false_positives = False positives should be limited, but if any are present, filter as needed. providing_technologies = [] @@ -4028,7 +4088,7 @@ asset_type = confidence = medium explanation = The following detection identifies Microsoft Excel spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`. `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line executed will most likely be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]} known_false_positives = False positives should be limited, but if any are present, filter as needed. In some instances, `cscript.exe` is used for legitimate business practices. providing_technologies = [] @@ -4038,7 +4098,7 @@ asset_type = confidence = medium explanation = This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the compromised system. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. -annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]} known_false_positives = unknown providing_technologies = [] @@ -4048,7 +4108,7 @@ asset_type = Endpoint confidence = medium explanation = This search identifies DNS query failures by counting the number of DNS responses that do not indicate success, and trigger on more than 50 occurrences. how_to_implement = To successfully implement this search you must ensure that DNS data is populating the Network_Resolution data model. -annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} known_false_positives = It is possible legitimate traffic can trigger this rule. Please investigate as appropriate. The threshold for generating an event can also be customized to better suit your environment. providing_technologies = [] @@ -4058,7 +4118,7 @@ asset_type = confidence = medium explanation = This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue there objective and evade detections. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]} known_false_positives = unknown providing_technologies = [] @@ -4068,7 +4128,7 @@ asset_type = confidence = medium explanation = The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` or `icacls.exe` application to change file or folder permission. This behavior is commonly seen where the adversary attempts to impair some users from deleting or accessing its malware components or artifact from the compromised system. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} known_false_positives = Administrators or administrative scripts may use this application. Filter as needed. providing_technologies = [] @@ -4078,7 +4138,7 @@ asset_type = confidence = medium explanation = This analytic identifies excessive usage of `net.exe` or `net1.exe` within a bucket of time (1 minute). This behavior was seen in a Monero incident where the adversary attempts to create many users, delete and disable users as part of its malicious behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Scope:Local", "Stage:Execution"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Process", "Attacker"], "type": "Process Name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]} known_false_positives = unknown. Filter as needed. Modify the time span as needed. providing_technologies = [] @@ -4088,7 +4148,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application or to gain privilege escalation. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. -annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569.002"]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"]} known_false_positives = excessive execution of sc.exe is quite suspicious since it can modify or execute app in high privilege permission. providing_technologies = [] @@ -4098,7 +4158,7 @@ asset_type = confidence = medium explanation = This analytic identifies excessive usage of `taskkill.exe` application. This application is commonly used by adversaries to evade detections by killing security product processes or even other processes to evade detection. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. -annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = Unknown. Filter as needed. providing_technologies = [] @@ -4108,7 +4168,7 @@ asset_type = confidence = medium explanation = This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used. -annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "confidence": 70, "context": ["Source:Endpoint", "Scope:Local", "Stage:Exfiltration"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} known_false_positives = unknown providing_technologies = [] @@ -4118,7 +4178,7 @@ asset_type = confidence = medium explanation = This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. -annotations = {"analytic_story": ["Meterpreter"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. providing_technologies = [] @@ -4128,7 +4188,7 @@ asset_type = confidence = medium explanation = This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = Legitimate programs and administrators will execute sc.exe with the start disabled flag. It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time. providing_technologies = [] @@ -4138,7 +4198,7 @@ asset_type = confidence = medium explanation = This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various actions (discovery, lateral movement, etc.). It is extremely uncommon in the course of normal operations to see so many distinct taskhost and taskhostex processes running concurrently in a short time frame. how_to_implement = To successfully implement this search you need to be ingesting events related to processes on the endpoints that include the name of the process and process id into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Meterpreter"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"]} known_false_positives = Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. Filter as needed. providing_technologies = [] @@ -4152,7 +4212,7 @@ A suspicious event will have `PowerShell`, the method `POST` and `autodiscover.j An event will look similar to `POST /autodiscover/autodiscover.json a=dsxvu@fnsso.flq/powershell/?X-Rps-CAT=VgEAVAdXaW5kb3d...` (abbreviated) \ Review the source attempting to perform this activity against your environment. In addition, review PowerShell logs and access recently granted to Exchange roles. how_to_implement = The following analytic requires on-premise Exchange to be logging to Splunk using the TA - https://splunkbase.splunk.com/app/3225. Ensure logs are parsed correctly, or tune the analytic for your environment. -annotations = {"analytic_story": ["ProxyShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]} known_false_positives = Limited false positives, however, tune as needed. providing_technologies = [] @@ -4165,7 +4225,7 @@ Inherently, the usage of the modules is not malicious, but reviewing parallel pr Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \ Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG). how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["ProxyShell"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4175,7 +4235,7 @@ asset_type = confidence = medium explanation = This analytic will identify suspicious executable or scripts (known file extensions) in list of suspicious file path in Windows. This technique is used by adversaries to evade detection. The suspicious file path are known paths used in the wild and are not common to have executable or scripts. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -annotations = {"analytic_story": ["XMRig", "Remcos"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"]} known_false_positives = Administrators may allow creation of script or exe in the paths specified. Filter as needed. providing_technologies = [] @@ -4185,7 +4245,7 @@ asset_type = confidence = medium explanation = This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.005"]} known_false_positives = unknown providing_technologies = [] @@ -4195,7 +4255,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for processes launched from files with at least five spaces in the name before the extension. This is typically done to obfuscate the file extension by pushing it outside of the default view. how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} +annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} known_false_positives = None identified. providing_technologies = [] @@ -4205,7 +4265,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content. how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. -annotations = {"analytic_story": ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"], "cis20": ["CIS 3", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process", "role": ["Parent Process", "Attacker"], "type": "Process"}]} +annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} known_false_positives = None identified. providing_technologies = [] @@ -4215,7 +4275,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search returns a list of hosts that have not successfully completed a backup in over a week. Deprecated because it's a infrastructure monitoring. how_to_implement = To successfully implement this search you need to first obtain data from your backup solution, either from the backup logs on your hosts, or from a central server responsible for performing the backups. If you do not use Netbackup, you can modify this search for your backup solution. Depending on how often you backup your systems, you may want to modify how far in the past to look for a successful backup, other than the default of seven days. -annotations = {"analytic_story": ["Monitor Backup Solution"], "cis20": ["CIS 10"], "nist": ["PR.IP"]} +annotations = {"cis20": ["CIS 10"], "nist": ["PR.IP"]} known_false_positives = None identified providing_technologies = [] @@ -4225,7 +4285,7 @@ asset_type = confidence = medium explanation = The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["DarkSide Ransomware", "Credential Dumping"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]} known_false_positives = It is possible some agent based products will generate false positives. Filter as needed. providing_technologies = [] @@ -4235,7 +4295,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks for file writes with extensions consistent with a SamSam ransomware attack. how_to_implement = You must be ingesting data that records file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. -annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 100, "kill_chain_phases": ["Installation"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Because these extensions are not typically used in normal operations, you should investigate all results. providing_technologies = [] @@ -4245,7 +4305,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for child processes spawned by zoom.exe or zoom.us that has not previously been seen. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You should run the baseline search `Previously Seen Zoom Child Processes - Initial` to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search `Previously Seen Zoom Child Processes - Update` to keep this table up to date and to age out old child processes. Please update the `previously_seen_zoom_child_processes_window` macro to adjust the time window. -annotations = {"analytic_story": ["Suspicious Zoom Child Processes"], "cis20": ["CIS 3", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1068"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Attacker", "Child Process"], "type": "Process Name"}]} +annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1068"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} known_false_positives = A new child process of zoom isn't malicious by that fact alone. Further investigation of the actions of the child process is needed to verify any malicious behavior is taken. providing_technologies = [] @@ -4255,7 +4315,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for the first and last time a Windows service is seen running in your environment. This table is then cached. how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows system event logs in order for this search to execute successfully. You should run the baseline search `Previously Seen Running Windows Services - Initial` to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search `Previously Seen Running Windows Services - Update` to keep this table up to date and to age out old Windows Services. Please update the `previously_seen_windows_services_window` macro to adjust the time window. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. -annotations = {"analytic_story": ["Windows Service Abuse", "Orangeworm Attack Group", "NOBELIUM Group"], "cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]} +annotations = {"cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569", "T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]} known_false_positives = A previously unseen service is not necessarily malicious. Verify that the service is legitimate and that was installed by a legitimate process. providing_technologies = [] @@ -4265,7 +4325,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. Please make sure you run the support search "Previously seen command line arguments,"—which creates a lookup file called `previously_seen_cmd_line_arguments.csv`—a historical baseline of all command-line arguments. You must also validate this list. For the search to do accurate calculation, ensure the search scheduling is the same value as the `relative_time` evaluation function. -annotations = {"analytic_story": ["DHS Report TA18-074A", "Suspicious Command-Line Executions", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Hidden Cobra Malware"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001", "T1059.003"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001", "T1059.003"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} known_false_positives = Legitimate programs can also use command-line arguments to execute. Please verify the command-line arguments to check what command/program is being executed. We recommend customizing the `first_time_seen_cmd_line_filter` macro to exclude legitimate parent_process_name providing_technologies = [] @@ -4279,7 +4339,7 @@ explanation = Fodhelper.exe has a known UAC bypass as it attempts to look for sp 1. `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)`\ Upon triage, fodhelper.exe will have a child process and read access will occur on the registry keys. Isolate the endpoint and review parallel processes for additional behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1548.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} +annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1548.002", "T1548"]} known_false_positives = Limited to no false positives are expected. providing_technologies = [] @@ -4289,7 +4349,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070"]} known_false_positives = unknown providing_technologies = [] @@ -4299,7 +4359,7 @@ asset_type = GCP Account confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges at different projects depending on organization schema. how_to_implement = You must install splunk GCP add-on. This search works with gcp:pubsub:message logs -annotations = {"analytic_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} known_false_positives = Accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization providing_technologies = [] @@ -4309,7 +4369,7 @@ asset_type = GCP Account confidence = medium explanation = This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts. how_to_implement = You must install splunk GCP add-on. This search works with gcp:pubsub:message logs -annotations = {"analytic_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} known_false_positives = Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects providing_technologies = [] @@ -4319,7 +4379,7 @@ asset_type = GCP Account confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts to move laterally and escalate privileges. how_to_implement = You must install splunk GCP add-on. This search works with gcp:pubsub:message logs -annotations = {"analytic_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} known_false_positives = High risk permissions are part of any GCP environment, however it is important to track resource and accounts usage, this search may produce false positives. providing_technologies = [] @@ -4329,7 +4389,7 @@ asset_type = GCP GCR Container confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search show information on uploaded containers including source user, account, action, bucket name event name, http user agent, message and destination path. how_to_implement = You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a subpub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_gcp_detection_filter` macro to filter out the false positives. -annotations = {"analytic_story": ["Container Implantation Monitoring and Investigation"], "mitre_attack": ["T1525"]} +annotations = {"mitre_attack": ["T1525"]} known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. GCP GCR registers container upload as a Storage event, this search must be considered under the context of CONTAINER upload creation which automatically generates a bucket entry for destination path. providing_technologies = [] @@ -4339,7 +4399,7 @@ asset_type = GCP Kubernetes cluster confidence = medium explanation = This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster's pods how_to_implement = You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. -annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} known_false_positives = Not all unauthenticated requests are malicious, but frequency, User Agent, source IPs and pods will provide context. providing_technologies = [] @@ -4349,7 +4409,7 @@ asset_type = GCP Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster how_to_implement = You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection to filter out FPs. -annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} known_false_positives = Not all unauthenticated requests are malicious, but frequency, User Agent and source IPs will provide context. providing_technologies = [] @@ -4359,7 +4419,7 @@ asset_type = confidence = medium explanation = The following analytic identifies gpupdate.exe with no command line arguments and with a network connection. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "connection_to_CNC", "role": ["Other"], "type": "IP Address"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. providing_technologies = [] @@ -4369,7 +4429,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin. how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. -annotations = {"analytic_story": ["DevSecOps"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]} known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. providing_technologies = [] @@ -4379,7 +4439,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` executing the Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4389,7 +4449,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADDefaultDomainPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 30, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4399,7 +4459,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns a list of all domain users. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4409,7 +4469,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4419,7 +4479,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` executing the Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4429,7 +4489,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 30, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4439,7 +4499,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` executing the `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4449,7 +4509,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4459,7 +4519,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4469,7 +4529,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4479,7 +4539,7 @@ asset_type = confidence = medium explanation = The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} known_false_positives = False positives may be present. Tune as needed. providing_technologies = [] @@ -4491,7 +4551,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies the usage of `Get-WMIObject Win32_Group`, which is typically used as a way to identify groups on the endpoint. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} known_false_positives = False positives may be present. Tune as needed. providing_technologies = [] @@ -4501,7 +4561,7 @@ asset_type = confidence = medium explanation = This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} known_false_positives = Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. providing_technologies = [] @@ -4513,7 +4573,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} known_false_positives = It is possible certain system management frameworks utilize this command to gather trust information. providing_technologies = [] @@ -4523,7 +4583,7 @@ asset_type = confidence = medium explanation = This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an understanding of how large or small the domain is. During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} known_false_positives = Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. providing_technologies = [] @@ -4535,7 +4595,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]} known_false_positives = UPDATE_KNOWN_FALSE_POSITIVES providing_technologies = [] @@ -4545,7 +4605,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns a list of all domain computers. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4555,7 +4615,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4565,7 +4625,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. Red Teams and adversaries alike may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4575,7 +4635,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4585,7 +4645,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powerhsell.exe` with command-line arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4595,7 +4655,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4605,7 +4665,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use PowerView for troubleshooting. providing_technologies = [] @@ -4615,7 +4675,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use PowerView for troubleshooting. providing_technologies = [] @@ -4625,7 +4685,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use PowerView for troubleshooting. providing_technologies = [] @@ -4635,7 +4695,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4645,7 +4705,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4655,7 +4715,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this PowerView functions for troubleshooting. providing_technologies = [] @@ -4665,7 +4725,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for local users. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4675,7 +4735,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4685,7 +4745,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` commandlet lists the current TCP connections. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4695,7 +4755,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-NetTcpconnection ` commandlet. This commandlet is used to return a listing of network connections on a compromised system. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4705,7 +4765,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4715,7 +4775,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery. how_to_implement = he following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4725,7 +4785,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined with the `DS_Computer` parameter can be used to return a list of all domain computers. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4735,7 +4795,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4745,7 +4805,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -4755,7 +4815,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4765,7 +4825,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4775,7 +4835,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] @@ -4785,7 +4845,7 @@ asset_type = GitHub confidence = medium explanation = This search looks for Dependabot Alerts in Github logs. how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repository", "role": ["Victim"], "type": "System"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -4795,7 +4855,7 @@ asset_type = GitHub confidence = medium explanation = This search looks for Pull Request from unknown user. how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repository", "role": ["Victim"], "type": "System"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -4805,7 +4865,7 @@ asset_type = confidence = medium explanation = This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch how_to_implement = To successfully implement this search, you need to be ingesting logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project. -annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"], "observable": [{"name": "commit.commit.author.email", "role": ["attacker"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"]} known_false_positives = admin can do changes directly to master branch providing_technologies = [] @@ -4815,7 +4875,7 @@ asset_type = confidence = medium explanation = This search is to detect a pushed or commit to develop branch. This is to avoid unwanted modification to develop without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch how_to_implement = To successfully implement this search, you need to be ingesting logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project. -annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"], "observable": [{"name": "commit.commit.author.email", "role": ["attacker"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"]} known_false_positives = admin can do changes directly to develop branch providing_technologies = [] @@ -4824,8 +4884,8 @@ type = detection asset_type = confidence = medium explanation = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. -how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. -annotations = {"analytic_story": ["DevSecOps"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 80, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]} +how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002", "T1567"]} known_false_positives = network admin or normal user may share files to customer and external team. providing_technologies = [] @@ -4835,7 +4895,7 @@ asset_type = confidence = medium explanation = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail. how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. -annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]} known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search. providing_technologies = [] @@ -4845,7 +4905,7 @@ asset_type = confidence = medium explanation = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services. how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. -annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]} known_false_positives = normal email contains this link that are known application within the organization or network can be catched by this detection. providing_technologies = [] @@ -4855,7 +4915,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment. how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. -annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"]} known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. providing_technologies = [] @@ -4864,8 +4924,8 @@ type = detection asset_type = confidence = medium explanation = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer. -how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. -annotations = {"analytic_story": ["DevSecOps"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]} +how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]} known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search providing_technologies = [] @@ -4875,7 +4935,7 @@ asset_type = confidence = medium explanation = This analytic identifies a suspicious registry modification to hide a user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will create a hidden user account with Admin privileges in login screen to avoid noticing by the user that they already compromise and to persist on that said machine. how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "registry_value_name", "role": ["Attacker"], "type": "Other"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = Unknown. Filter as needed. providing_technologies = [] @@ -4885,7 +4945,7 @@ asset_type = confidence = medium explanation = Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe to hide files. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Attacker", "Parent Process"], "type": "Other"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222", "T1222.001"], "nist": ["DE.CM"]} known_false_positives = Some applications and users may legitimately use attrib.exe to interact with the files. providing_technologies = [] @@ -4895,7 +4955,7 @@ asset_type = confidence = medium explanation = This search looks for high frequency of file deletion relative to process name and process id. These events usually happen when the ransomware tries to encrypt the files with the ransomware file extensions and sysmon treat the original files to be deleted as soon it was replace as encrypted data. how_to_implement = To successfully implement this search, you need to be ingesting logs with the deleted target file name, process name and process id from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "deleted_files", "role": ["Target"], "type": "File Name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"]} known_false_positives = user may delete bunch of pictures or files in a folder. providing_technologies = [] @@ -4905,7 +4965,7 @@ asset_type = Office 365 confidence = medium explanation = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. how_to_implement = -annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001", "T1110"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = unknown providing_technologies = [] @@ -4915,7 +4975,7 @@ asset_type = confidence = medium explanation = This analytics are designed to indentify a high frequency of process termination on a machine which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption. how_to_implement = To successfully implement this search, you need to be ingesting logs with the Image (process full path of terminated process) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "proc_terminated", "role": ["Target"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]} known_false_positives = admin or user tool that can terminate multiple process. providing_technologies = [] @@ -4925,7 +4985,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server. how_to_implement = This search requires you to be ingesting your network traffic and populating the Network_Traffic data model. Your email servers must be categorized as "email_server" for the search to work, as well. You may need to adjust the deviation_threshold and minimum_data_samples values based on the network traffic in your environment. The "deviation_threshold" field is a multiplying factor to control how much variation you're willing to tolerate. The "minimum_data_samples" field is the minimum number of connections of data samples required for the statistic to be valid. -annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} +annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} known_false_positives = The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers. providing_technologies = [] @@ -4935,7 +4995,7 @@ asset_type = confidence = medium explanation = This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft and coinminer scripts to evade detections and restrict access to their component files. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} known_false_positives = Unknown. Filter as needed. providing_technologies = [] @@ -4945,7 +5005,7 @@ asset_type = confidence = medium explanation = This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent access to their component files. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used. -annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} known_false_positives = Unknown. It is possible some administrative scripts use ICacls. Filter as needed. providing_technologies = [] @@ -4955,7 +5015,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious file creation namely passff.tar and cookie.tar. This files are possible archived of stolen browser information like history and cookies in a compromised machine with IcedID. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"]} known_false_positives = unknown providing_technologies = [] @@ -4965,7 +5025,7 @@ asset_type = Domain Server confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the past week. how_to_implement = To successfully implement this search, you need to be populating the Enterprise Security Identity_Management data model in the assets and identity framework. -annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.002"], "nist": ["PR.IP"]} +annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.002"], "nist": ["PR.IP"]} known_false_positives = If the Identity_Management data model is not updated regularly, this search could give you false positive alerts. Please consider this and investigate appropriately. providing_technologies = [] @@ -4975,7 +5035,7 @@ asset_type = confidence = medium explanation = This search is to detect a execution of jscript using cscript process. Commonly when a user run jscript file it was executed by wscript.exe application. This technique was seen in FIN7 js implant to execute its malicious script using cscript process. This behavior is uncommon and a good artifacts to check further anomalies within the network how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["FIN7"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]} known_false_positives = unknown providing_technologies = [] @@ -4985,7 +5045,7 @@ asset_type = Endpoint confidence = medium explanation = This search detects a potential kerberoasting attack via service principal name requests how_to_implement = You must be ingesting endpoint data that tracks process activity, and include the windows security event logs that contain kerberos -annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 8", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558.003", "T1558"], "nist": ["DE.CM"]} known_false_positives = Older systems that support kerberos RC4 by default NetApp may generate false positives providing_technologies = [] @@ -4995,7 +5055,7 @@ asset_type = confidence = medium explanation = This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing the targetted files it wants to encrypts because of the open handle of those services to the targetted file. how_to_implement = To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. -annotations = {"analytic_story": ["Ransomware", "BlackMatter Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Message", "role": ["Other"], "type": "Other"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = Admin activities or installing related updates may do a sudden stop to list of services we monitor. providing_technologies = [] @@ -5005,7 +5065,7 @@ asset_type = AWS EKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs -annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted. providing_technologies = [] @@ -5015,7 +5075,7 @@ asset_type = AWS EKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs -annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Not all service accounts interactions are malicious. Analyst must consider IP, verb and decision context when trying to detect maliciousness. providing_technologies = [] @@ -5025,7 +5085,7 @@ asset_type = AWS EKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs. -annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. providing_technologies = [] @@ -5035,7 +5095,7 @@ asset_type = AWS EKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or rare operators to find trends or rarities in failure status, user agents, source IPs and request URI how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs. -annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = This search can give false positives as there might be inherent issues with authentications and permissions at cluster. providing_technologies = [] @@ -5045,7 +5105,7 @@ asset_type = AWS EKS Kubernetes cluster confidence = medium explanation = This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs. -annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially anonymous suspicious IPs and sensitive objects such as configmaps or secrets providing_technologies = [] @@ -5055,7 +5115,7 @@ asset_type = Azure AKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics -annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted. providing_technologies = [] @@ -5065,7 +5125,7 @@ asset_type = Azure AKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics -annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Not all service accounts interactions are malicious. Analyst must consider IP and verb context when trying to detect maliciousness. providing_technologies = [] @@ -5075,7 +5135,7 @@ asset_type = Azure AKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics -annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection. providing_technologies = [] @@ -5085,7 +5145,7 @@ asset_type = Azure AKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics -annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. providing_technologies = [] @@ -5095,7 +5155,7 @@ asset_type = Azure AKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes service accounts with failure or forbidden access status how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics -annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = This search can give false positives as there might be inherent issues with authentications and permissions at cluster. providing_technologies = [] @@ -5105,7 +5165,7 @@ asset_type = Azure AKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on rare Kubectl calls with IP, verb namespace and object access context how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics -annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially suspicious IPs and sensitive objects such as configmaps or secrets providing_technologies = [] @@ -5115,7 +5175,7 @@ asset_type = Azure AKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics -annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"]} +annotations = {"kill_chain_phases": ["Reconnaissance"]} known_false_positives = Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context. providing_technologies = [] @@ -5125,7 +5185,7 @@ asset_type = Azure AKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics -annotations = {"analytic_story": ["Kubernetes Scanning Activity"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} known_false_positives = Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context. providing_technologies = [] @@ -5135,7 +5195,7 @@ asset_type = GCP GKE Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences how_to_implement = You must install splunk AWS add on for GCP. This search works with pubsub messaging service logs -annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted. providing_technologies = [] @@ -5145,7 +5205,7 @@ asset_type = GCP GKE Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision how_to_implement = You must install splunk GCP add on. This search works with pubsub messaging service logs -annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Not all service accounts interactions are malicious. Analyst must consider IP, verb and decision context when trying to detect maliciousness. providing_technologies = [] @@ -5155,7 +5215,7 @@ asset_type = GCP GKE Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets how_to_implement = You must install splunk add on for GCP . This search works with pubsub messaging service logs. -annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection. providing_technologies = [] @@ -5165,7 +5225,7 @@ asset_type = GCP GKE EKS Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets how_to_implement = You must install splunk add on for GCP. This search works with pubsub messaging servicelogs. -annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Sensitive role resource access is necessary for cluster operation, however source IP, user agent, decision and reason may indicate possible malicious use. providing_technologies = [] @@ -5175,7 +5235,7 @@ asset_type = GCP GKE Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or rare operators to find trends or rarities in failure status, user agents, source IPs and request URI how_to_implement = You must install splunk add on for GCP. This search works with pubsub messaging service logs. -annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = This search can give false positives as there might be inherent issues with authentications and permissions at cluster. providing_technologies = [] @@ -5185,7 +5245,7 @@ asset_type = GCP GKE Kubernetes cluster confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context how_to_implement = You must install splunk add on for GCP. This search works with pubsub messaging logs. -annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} +annotations = {"kill_chain_phases": ["Lateral Movement"]} known_false_positives = Kubectl calls are not malicious by nature. However source IP, source user, user agent, object path, and authorization context can reveal potential malicious activity, specially anonymous suspicious IPs and sensitive objects such as configmaps or secrets providing_technologies = [] @@ -5195,7 +5255,7 @@ asset_type = Kubernetes confidence = medium explanation = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks. how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -5205,7 +5265,7 @@ asset_type = Kubernetes confidence = medium explanation = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks. how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -5215,7 +5275,7 @@ asset_type = Kubernetes confidence = medium explanation = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner. how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes. -annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "host", "type": "Entity"}]} +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -5225,7 +5285,7 @@ asset_type = DNS Servers confidence = medium explanation = The search is used to identify attempts to use your DNS Infrastructure for DDoS purposes via a DNS amplification attack leveraging ANY queries. how_to_implement = To successfully implement this search you must ensure that DNS data is populating the Network_Resolution data model. -annotations = {"analytic_story": ["DNS Amplification Attacks"], "cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498.002"], "nist": ["PR.PT", "DE.AE", "PR.IP"]} +annotations = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498", "T1498.002"], "nist": ["PR.PT", "DE.AE", "PR.IP"]} known_false_positives = Legitimate ANY requests may trigger this search, however it is unusual to see a large volume of them under typical circumstances. You may modify the threshold in the search to better suit your environment. providing_technologies = [] @@ -5235,7 +5295,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -5245,17 +5305,27 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] +[savedsearch://ESCU - Logon Script Event Trigger Execution - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1037", "T1037.001"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - MS Scripting Process Loading Ldap Module - Rule] type = detection asset_type = confidence = medium explanation = This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading ldap module to process ldap query. This behavior was seen in FIN7 implant where it uses javascript to execute ldap query to parse host information that will send to its C2 server. this anomaly detections is a good initial step to hunt further a suspicious ldap query or ldap related events to the host that may give you good information regarding ldap or AD information processing or might be a attacker. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["FIN7"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]} known_false_positives = automation scripting language may used by network operator to do ldap query. providing_technologies = [] @@ -5265,17 +5335,27 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading wmi module to process wmi query. This behavior was seen in FIN7 implant where it uses javascript to execute wmi query to parse host information that will send to its C2 server. this anomaly detections is a good initial step to hunt further a suspicious wmi query or wmi related events to the host that may give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["FIN7"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]} known_false_positives = automation scripting language may used by network operator to do ldap query. providing_technologies = [] +[savedsearch://ESCU - MSBuild Suspicious Spawned By Script Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the compromised host. During triage, review parallel processes and identify any file modifications. MSBuild may load a script from the same path without having command-line arguments. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1127"]} +known_false_positives = False positives should be limited as developers do not spawn MSBuild via a WSH. +providing_technologies = [] + [savedsearch://ESCU - MSHTML Module Load in Office Product - Rule] type = detection asset_type = confidence = medium explanation = The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = Limited false positives will be present, however, tune as necessary. providing_technologies = [] @@ -5295,17 +5375,27 @@ asset_type = confidence = medium explanation = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. -annotations = {"analytic_story": ["Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114", "T1114.001"]} known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Malicious InProcServer32 Modification - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID). Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.010", "T1112"]} +known_false_positives = False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line. +providing_technologies = [] + [savedsearch://ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule] type = detection asset_type = Endpoint confidence = medium -explanation = This search looks for PowerShell processes started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet. This combination of command-line options is suspicious because it's overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Deprecated becaue hidden is not needed when download file with System.Net.WebClient. -how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Attacker"], "type": "Process"}]} +explanation = The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Removed in this version of the query is New-Object. The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. +how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. +annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001", "T1059"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} known_false_positives = Legitimate process can have this combination of command-line options, but it's not common. providing_technologies = [] @@ -5313,9 +5403,12 @@ providing_technologies = [] type = detection asset_type = Endpoint confidence = medium -explanation = This search looks for PowerShell processes that have encoded the script within the command-line. Malware has been seen using this parameter, as it obfuscates the code and makes it relatively easy to pass a script on the command-line. +explanation = The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \ +The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \ +During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \ +Alternatively, may use regex per matching here https://regexr.com/662ov. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Malicious PowerShell", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} known_false_positives = System administrators may use this option, but it's not common. providing_technologies = [] @@ -5325,7 +5418,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed in attacks leveraging PowerShell scripts as they override the default PowerShell execution policy. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} known_false_positives = There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate. providing_technologies = [] @@ -5335,7 +5428,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} known_false_positives = Legitimate process can have this combination of command-line options, but it's not common. providing_technologies = [] @@ -5345,7 +5438,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} known_false_positives = These characters might be legitimately on the command-line, but it is not common. providing_technologies = [] @@ -5355,7 +5448,7 @@ asset_type = confidence = medium explanation = This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. how_to_implement = To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -annotations = {"analytic_story": ["Malicious Powershell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569", "T1569.002"]} known_false_positives = Creating a hidden powershell service is rare and could key off of those instances. providing_technologies = [] @@ -5365,7 +5458,7 @@ asset_type = confidence = medium explanation = This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. how_to_implement = To successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Ransomware", "Revil Ransomware", "BlackMatter Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"]} known_false_positives = 3rd party tool may used to changed the wallpaper of the machine providing_technologies = [] @@ -5375,7 +5468,7 @@ asset_type = confidence = medium explanation = This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner with appropriate permission. This behavior is a good indicator if this command seen on a machine utilized by an account with no permission to do so. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used. -annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} known_false_positives = administrators may use this command. Filter as needed. providing_technologies = [] @@ -5385,7 +5478,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse. how_to_implement = You need to ingest data from your DNS logs. Specifically you must ingest the domain that is being queried and the IP of the host originating the request. Ideally, you should also be ingesting the answer to the query and the query type. This approach allows you to also create your own localized passive DNS capability which can aid you in future investigations. You also need to have run the search "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that will be checked for. -annotations = {"analytic_story": ["Brand Monitoring"], "kill_chain_phases": ["Delivery", "Actions on Objectives"]} +annotations = {"kill_chain_phases": ["Delivery", "Actions on Objectives"]} known_false_positives = None at this time providing_technologies = [] @@ -5395,7 +5488,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for emails claiming to be sent from a domain similar to one that you want to have monitored for abuse. how_to_implement = You need to ingest email header data. Specifically the sender's address (src_user) must be populated. You also need to have run the search "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that will be checked for. -annotations = {"analytic_story": ["Brand Monitoring", "Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} +annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} known_false_positives = None at this time providing_technologies = [] @@ -5405,7 +5498,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. -annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8", "CIS 5"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010", "T1547"], "nist": ["PR.PT", "DE.CM", "PR.AC"]} known_false_positives = You will encounter noise from legitimate print-monitor registry entries. providing_technologies = [] @@ -5415,7 +5508,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for Web requests to faux domains similar to the one that you want to have monitored for abuse. how_to_implement = You need to ingest data from your web traffic. This can be accomplished by indexing data from a web proxy, or using a network traffic analysis tool, such as Bro or Splunk Stream. You also need to have run the search "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that will be checked for. -annotations = {"analytic_story": ["Brand Monitoring"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} +annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} known_false_positives = None at this time providing_technologies = [] @@ -5425,7 +5518,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Trickbot", "IcedID"], "confidence": 80, "context": ["source:endpoint", {"stage": "executions"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"]} known_false_positives = limitted. this anomaly behavior is not commonly seen in clean host. providing_technologies = [] @@ -5435,7 +5528,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002"]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"]} known_false_positives = quite minimal false positive expected. providing_technologies = [] @@ -5445,7 +5538,7 @@ asset_type = confidence = medium explanation = This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its C2 through HTTP POST. Sometimes adversaries will rename the archive files or encode/encrypt to cover their tracks. This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration. how_to_implement = To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled in stream http configuration. -annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "UriPath"}, {"name": "form_data", "role": ["Attacker"], "type": "formdata"}]} +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003", "T1048"]} known_false_positives = Normal archive transfer via HTTP protocol may trip this detection. providing_technologies = [] @@ -5458,7 +5551,7 @@ The detection calculates the standard deviation for each host and leverages the This detection will only trigger on domain controllers, not on member servers or workstations.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. -annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} known_false_positives = A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. providing_technologies = [] @@ -5471,7 +5564,7 @@ The detection calculates the standard deviation for each host and leverages the This detection will only trigger on domain controllers, not on member servers or workstations.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. -annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. providing_technologies = [] @@ -5484,7 +5577,7 @@ The detection calculates the standard deviation for each host and leverages the This detection will only trigger on domain controllers, not on member servers or workstations.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. -annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. providing_technologies = [] @@ -5494,7 +5587,7 @@ asset_type = Infrastructure confidence = medium explanation = This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. -annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} known_false_positives = A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise the threshold or except specific IP adresses from triggering this search. providing_technologies = [] @@ -5507,7 +5600,7 @@ The detection calculates the standard deviation for each host and leverages the This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. -annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} known_false_positives = A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. providing_technologies = [] @@ -5520,7 +5613,7 @@ The detection calculates the standard deviation for each host and leverages the This detection will only trigger on domain controllers, not on member servers or workstations.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. -annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} known_false_positives = A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, missconfigured systems and multi-user systems like Citrix farms. providing_technologies = [] @@ -5533,7 +5626,7 @@ The detection calculates the standard deviation for each host and leverages the This detection will only trigger on domain controllers, not on member servers or workstations.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled. -annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} known_false_positives = A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. providing_technologies = [] @@ -5546,7 +5639,7 @@ The detection calculates the standard deviation for each host and leverages the This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server or workstation.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. -annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} known_false_positives = A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. providing_technologies = [] @@ -5559,7 +5652,7 @@ The detection calculates the standard deviation for each host and leverages the This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. -annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} known_false_positives = A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc. providing_technologies = [] @@ -5569,7 +5662,7 @@ asset_type = confidence = medium explanation = This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} known_false_positives = limited false positive. It may trigger by some windows update that will modify this registry. providing_technologies = [] @@ -5579,7 +5672,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information. Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Ryuk Ransomware", "Domain Trust Discovery", "IcedID", "Active Directory Discovery"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Administrators may use nltest for troubleshooting purposes, otherwise, rarely used. providing_technologies = [] @@ -5589,7 +5682,7 @@ asset_type = confidence = medium explanation = The following hunting analytic will identify the use of localgroup discovery using `net localgroup`. During triage, review parallel processes and identify any further suspicious behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} known_false_positives = False positives may be present. Tune as needed. providing_technologies = [] @@ -5599,7 +5692,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `arp.exe` utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use arp.exe for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -5609,7 +5702,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `net.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use net.exe for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -5619,7 +5712,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `netstat.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use netstat.exe for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -5629,7 +5722,7 @@ asset_type = AWS ECR container confidence = medium explanation = This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives. -annotations = {"analytic_story": ["Container Implantation Monitoring and Investigation"], "mitre_attack": ["T1525"]} +annotations = {"mitre_attack": ["T1525"]} known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. providing_technologies = [] @@ -5639,7 +5732,7 @@ asset_type = confidence = medium explanation = This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a call back to a remote command and control server. This is a powershell oneliner. In addition, this will capture on the command-line additional utilities used by Nishang. Triage the endpoint and identify any parallel processes that look suspicious. Review the reputation of the remote IP or domain contacted by the powershell process. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command and Control"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} known_false_positives = Limited false positives may be present. Filter as needed based on initial analysis. providing_technologies = [] @@ -5649,7 +5742,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for Windows endpoints that have not generated an event indicating a successful Windows update in the last 60 days. Windows updates are typically released monthly and applied shortly thereafter. An endpoint that has not successfully applied an update in this time frame indicates the endpoint is not regularly being patched for some reason. how_to_implement = To successfully implement this search, it requires that the 'Update' data model is being populated. This can be accomplished by ingesting Windows events or the Windows Update log via a universal forwarder on the Windows endpoints you wish to monitor. The Windows add-on should be also be installed and configured to properly parse Windows events in Splunk. There may be other data sources which can populate this data model, including vulnerability management systems. -annotations = {"analytic_story": ["Monitor for Updates"], "cis20": ["CIS 18"], "nist": ["PR.PT", "PR.MA"]} +annotations = {"cis20": ["CIS 18"], "nist": ["PR.PT", "PR.MA"]} known_false_positives = None identified providing_technologies = [] @@ -5659,7 +5752,7 @@ asset_type = confidence = medium explanation = This search is to detect an anomaly event of non-chrome process accessing the files in chrome user default folder. This folder contains all the sqlite database of the chrome browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable. how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -annotations = {"analytic_story": ["FIN7"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555", "T1555.003"]} known_false_positives = other browser not listed related to firefox may catch by this rule. providing_technologies = [] @@ -5669,7 +5762,7 @@ asset_type = confidence = medium explanation = This search is to detect an anomaly event of non-firefox process accessing the files in profile folder. This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable. how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -annotations = {"analytic_story": ["FIN7"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555", "T1555.003"]} known_false_positives = other browser not listed related to firefox may catch by this rule. providing_technologies = [] @@ -5681,7 +5774,7 @@ explanation = Monitor for signs that Ntdsutil is being used to Extract Active Di ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \ This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]} known_false_positives = Highly possible Server Administrators will troubleshoot with ntdsutil.exe, generating false positives. providing_technologies = [] @@ -5691,7 +5784,7 @@ asset_type = Office 365 confidence = medium explanation = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity -annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Actor.ID", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]} known_false_positives = The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. providing_technologies = [] @@ -5701,7 +5794,7 @@ asset_type = Office 365 confidence = medium explanation = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity -annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Target.ID", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]} known_false_positives = The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. providing_technologies = [] @@ -5711,7 +5804,7 @@ asset_type = Office 365 confidence = medium explanation = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. how_to_implement = You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity -annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007"], "observable": [{"name": "ip_addresses_new_added", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_id", "role": ["Attacker"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007", "T1562"]} known_false_positives = Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration. providing_technologies = [] @@ -5721,7 +5814,7 @@ asset_type = Office 365 confidence = medium explanation = This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity -annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]} known_false_positives = Unless it is a special case, it is uncommon to disable MFA or Strong Authentication providing_technologies = [] @@ -5731,7 +5824,7 @@ asset_type = Office 365 confidence = medium explanation = This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity -annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Initial Access"], "impact": 80, "kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110"]} known_false_positives = The threshold for alert is above 10 attempts and this should reduce the number of false positives. providing_technologies = [] @@ -5741,7 +5834,7 @@ asset_type = Office 365 confidence = medium explanation = This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse. how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity -annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Initial Access"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "UserId", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]} known_false_positives = Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack. providing_technologies = [] @@ -5751,7 +5844,7 @@ asset_type = Office 365 confidence = medium explanation = This search detects the addition of a new Federated domain. how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity. -annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "OrganizationName", "role": ["Victim"], "type": "Other"}, {"name": "UserId", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]} known_false_positives = The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. providing_technologies = [] @@ -5761,7 +5854,7 @@ asset_type = Office 365 confidence = medium explanation = This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity -annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Exfiltration"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1114"], "observable": [{"name": "Source", "role": ["Attacker"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1114"]} known_false_positives = PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored. providing_technologies = [] @@ -5771,7 +5864,7 @@ asset_type = Office 365 confidence = medium explanation = This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination. how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity -annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Exfiltration"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = unknown providing_technologies = [] @@ -5781,7 +5874,7 @@ asset_type = Office 365 confidence = medium explanation = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account. how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity -annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = Service Accounts providing_technologies = [] @@ -5791,7 +5884,7 @@ asset_type = Office 365 confidence = medium explanation = This search detects when multiple user configured a forwarding rule to the same destination. how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity -annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "ForwardingSmtpAddress", "role": ["Other"], "type": "Email Address"}]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"]} known_false_positives = unknown providing_technologies = [] @@ -5801,7 +5894,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious MS office application that drop or create executables or script in the host. This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen in normal office application how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["FIN7"], "confidence": 80, "context": ["Source:Endpoint", "Stage:recon"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = office macro for automation may do this behavior providing_technologies = [] @@ -5811,7 +5904,7 @@ asset_type = confidence = medium explanation = this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like IcedID that used MS office as its weapon or attack vector to initially infect the machines. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = unknown providing_technologies = [] @@ -5821,7 +5914,7 @@ asset_type = confidence = medium explanation = this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack vector to initially infect the machines. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot", "IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = unknown providing_technologies = [] @@ -5831,7 +5924,7 @@ asset_type = confidence = medium explanation = this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. This technique was seen in so many malicious macro malware that create persistence , beaconing using task schedule malware entry The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. -annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = unknown providing_technologies = [] @@ -5841,7 +5934,7 @@ asset_type = confidence = medium explanation = this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office document as an attachment that may execute malicious payload, download malware payload or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. -annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot", "IcedID"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = Normal Office Document macro use for automation providing_technologies = [] @@ -5851,7 +5944,7 @@ asset_type = confidence = medium explanation = This search is to detect potential malicious office document executing lolbin child process to download payload or other malware. Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances office application and browser may be used. -annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = Default browser not in the filter list. providing_technologies = [] @@ -5861,7 +5954,7 @@ asset_type = confidence = medium explanation = this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["source:endpoint", {"stage": "executions"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"]} known_false_positives = IT or network admin may create an document automation that will run shell script. providing_technologies = [] @@ -5871,7 +5964,7 @@ asset_type = confidence = medium explanation = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line arguments as transfer, Download, priority, Foreground. In addition, Threat Research has released a detections identifying suspicious use of `bitsadmin.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = No false positives known. Filter as needed. providing_technologies = [] @@ -5881,7 +5974,7 @@ asset_type = confidence = medium explanation = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `certutil.exe`. In malicious instances, the command-line of `certutil.exe` will contain a URL to a remote destination. In addition, Threat Research has released a detections identifying suspicious use of `certutil.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `certutil.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = No false positives known. Filter as needed. providing_technologies = [] @@ -5891,7 +5984,7 @@ asset_type = confidence = medium explanation = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `mshta.exe`. In malicious instances, the command-line of `mshta.exe` will contain the `hta` file locally, or a URL to the remote destination. In addition, Threat Research has released a detections identifying suspicious use of `mshta.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `mshta.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Spearphishing Attachments", "IcedID"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = No false positives known. Filter as needed. providing_technologies = [] @@ -5901,7 +5994,7 @@ asset_type = confidence = medium explanation = The following detection identifies the latest behavior utilized by IcedID malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. In addition, Threat Research has released a detection identifying the use of `DllRegisterServer` on the command-line of `rundll32.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze the `DLL` that was dropped to disk. The Office Product will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = False positives should be limited, but if any are present, filter as needed. providing_technologies = [] @@ -5911,7 +6004,7 @@ asset_type = confidence = medium explanation = The following detection identifies the latest behavior utilized by Ursnif malware family. This detection identifies any Windows Office Product spawning `wmic.exe`. In malicious instances, the command-line of `wmic.exe` will contain `wmic process call create`. In addition, Threat Research has released a detection identifying the use of `wmic process call create` on the command-line of `wmic.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Spearphishing Attachments", "FIN7"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = No false positives known. Filter as needed. providing_technologies = [] @@ -5921,7 +6014,7 @@ asset_type = confidence = medium explanation = The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. -annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. providing_technologies = [] @@ -5931,7 +6024,7 @@ asset_type = confidence = medium explanation = The following detection identifies control.exe spawning from an office product. This detection identifies any Windows Office Product spawning `control.exe`. In malicious instances, the command-line of `control.exe` will contain a file path to a .cpl or .inf, related to CVE-2021-40444. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. review parallel and child processes to identify further suspicious behavior how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = Limited false positives should be present. providing_technologies = [] @@ -5941,7 +6034,7 @@ asset_type = Infrastructure confidence = medium explanation = Detect Okta user lockout events how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. -annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} known_false_positives = None. Account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor. providing_technologies = [] @@ -5951,7 +6044,7 @@ asset_type = Infrastructure confidence = medium explanation = Detect failed Okta SSO events how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. -annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} known_false_positives = There may be a faulty config preventing legitmate users from accessing apps they should have access to. providing_technologies = [] @@ -5961,7 +6054,7 @@ asset_type = Infrastructure confidence = medium explanation = This search detects logins from the same user from different cities in a 24 hour period. how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. -annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} known_false_positives = Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should *not* be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint. providing_technologies = [] @@ -5971,7 +6064,7 @@ asset_type = Splunk Server confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search allows you to look for evidence of exploitation for CVE-2016-4859, the Splunk Open Redirect Vulnerability. how_to_implement = No extra steps needed to implement this search. -annotations = {"analytic_story": ["Splunk Enterprise Vulnerability"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} +annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} known_false_positives = None identified providing_technologies = [] @@ -5981,7 +6074,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for ColdRoot events from the osx-attacks osquery pack. how_to_implement = In order to properly run this search, Splunk needs to ingest data from your osquery deployed agents with the [osx-attacks.conf](https://github.com/facebook/osquery/blob/experimental/packs/osx-attacks.conf#L599) pack enabled. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the Alerts data model -annotations = {"analytic_story": ["ColdRoot MacOS RAT"], "cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Installation", "Command and Control"], "nist": ["DE.DP", "DE.CM", "PR.PT"]} +annotations = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Installation", "Command and Control"], "nist": ["DE.DP", "DE.CM", "PR.PT"]} known_false_positives = There are no known false positives. providing_technologies = [] @@ -5991,7 +6084,7 @@ asset_type = Endpoint confidence = medium explanation = Microsoft Windows contains accessibility features that can be launched with a key combination before a user has logged in. An adversary can modify or replace these programs so they can get a command prompt or backdoor without logging in to the system. This search looks for modifications to these binaries. how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. -annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "privilege escalation"}], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.008"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Attacker"], "type": "file_path"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546", "T1546.008"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle. providing_technologies = [] @@ -6001,7 +6094,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `net.exe` or `net1.exe` with command line arguments used to obtain the domain password policy. Red Teams and adversaries may leverage `net.exe` for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -6011,7 +6104,7 @@ asset_type = confidence = medium explanation = This search is to detect a modification of file or directory permission using takeown.exe windows app. This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} known_false_positives = takeown.exe is a normal windows application that may used by network operator. providing_technologies = [] @@ -6024,7 +6117,7 @@ To enable 5145 events via Group Policy - Computer Configuration->Polices->Window It is possible this is not enabled by default and may need to be reviewed and enabled. \ During triage, review parallel security events to identify further suspicious activity. how_to_implement = Windows Event Code 5145 is required to utilize this analytic and it may not be enabled in most environments. -annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1187"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1187"]} known_false_positives = False positives have been limited when the Anonymous Logon is used for Account Name. providing_technologies = [] @@ -6034,7 +6127,7 @@ asset_type = confidence = medium explanation = The following analytic identifes Event Code 4768, A `Kerberos authentication ticket (TGT) was requested`, successfull occurs. This behavior has been identified to assist with detecting PetitPotam, CVE-2021-36942. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to Domain Controllers for your environment. how_to_implement = The following analytic requires Event Code 4768. Ensure that it is logging no Domain Controllers and appearing in Splunk. -annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1003"]} known_false_positives = False positives are possible if the environment is using certificates for authentication. providing_technologies = [] @@ -6044,7 +6137,7 @@ asset_type = confidence = medium explanation = This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data exfiltration. how_to_implement = To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled. -annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "UriPath"}, {"name": "form_data", "role": ["Attacker"], "type": "formdata"}]} +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003", "T1048"]} known_false_positives = unknown providing_technologies = [] @@ -6054,7 +6147,7 @@ asset_type = confidence = medium explanation = The following Hunting analytic assists with identifying suspicious PowerShell execution using Script Block Logging, or EventCode 4104. This analytic is not meant to be ran hourly, but occasionally to identify malicious or suspicious PowerShell. This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team. how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} known_false_positives = Limited false positives. May filter as needed. providing_technologies = [] @@ -6066,7 +6159,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 70, "context": ["source:endpoint", {"stage": "recon"}], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059", "T1059.001"]} known_false_positives = It is possible there will be false positives, filter as needed. providing_technologies = [] @@ -6076,7 +6169,7 @@ asset_type = confidence = medium explanation = The following hunting analytic identifies the use of `get-localgroup` being used with PowerShell to identify local groups on the endpoint. During triage, review parallel processes and identify any further suspicious behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} known_false_positives = False positives may be present. Tune as needed. providing_technologies = [] @@ -6088,7 +6181,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} known_false_positives = False positives should be limited as day to day scripts do not use this method. providing_technologies = [] @@ -6098,7 +6191,7 @@ asset_type = confidence = medium explanation = Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functionality is present. This technique variation is not as commonly used by adversaries, but has been abused in the past. Lesser known uses include the ability to set the `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` is used, it is highly possible files will be archived. During triage, review parallel processes and process lineage. Capture any files on disk and review. For the remote domain or IP, what is the reputation? how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["BITS Jobs"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"]} known_false_positives = Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments. providing_technologies = [] @@ -6108,7 +6201,7 @@ asset_type = confidence = medium explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"]} known_false_positives = powershell developer may used this function in their script for instance checking too. providing_technologies = [] @@ -6118,7 +6211,7 @@ asset_type = confidence = medium explanation = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = Limited false positives. However, tune based on scripts that may perform this action. providing_technologies = [] @@ -6128,7 +6221,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. -annotations = {"analytic_story": ["Malicious PowerShell", "Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"]} known_false_positives = network operator may enable or disable this windows feature. providing_technologies = [] @@ -6138,7 +6231,7 @@ asset_type = confidence = medium explanation = This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Malicious PowerShell", "Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015", "T1546"]} known_false_positives = network operrator may use this command. providing_technologies = [] @@ -6151,7 +6244,7 @@ This analytic identifies `GetProcAddress` in the script block. This is not norma In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later referenced/executed elsewhere. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "recon"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1055", "T1059.001"]} known_false_positives = Limited false positives. Filter as needed. providing_technologies = [] @@ -6164,7 +6257,7 @@ This analytic identifies `FromBase64String` within the script block. A typical m Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1027", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059", "T1027", "T1059.001"]} known_false_positives = False positives should be limited. Filter as needed. providing_technologies = [] @@ -6176,7 +6269,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies PowerShell cmdlet - `get-localgroup` being ran. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} known_false_positives = False positives may be present. Tune as needed. providing_technologies = [] @@ -6186,7 +6279,7 @@ asset_type = confidence = medium explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} known_false_positives = powershell may used this function to process compressed data. providing_technologies = [] @@ -6196,7 +6289,7 @@ asset_type = confidence = medium explanation = this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used. -annotations = {"analytic_story": ["Trickbot"], "confidence": 90, "context": ["source:endpoint", {"stage": "Defense Evasion"}, "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = unknown providing_technologies = [] @@ -6206,7 +6299,7 @@ asset_type = confidence = medium explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using memory stream as new object backstore. The malicious PowerShell script will contain stream flate data and will be decompressed in memory to run or drop the actual payload. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"]} known_false_positives = powershell may used this function to store out object into memory. providing_technologies = [] @@ -6216,10 +6309,20 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious bcdedit.exe execution to ignore all failures. This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used. -annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = Administrators may modify the boot configuration ignore failure during testing and debugging. providing_technologies = [] +[savedsearch://ESCU - Print Processor Registry Autostart - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a suspicious modification or new registry entry regarding print processor. This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine. This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} +known_false_positives = possible new printer installation may add driver component on this registry. +providing_technologies = [] + [savedsearch://ESCU - Print Spooler Adding A Printer Driver - Rule] type = detection asset_type = @@ -6228,7 +6331,7 @@ explanation = The following analytic identifies new printer drivers being load b Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began. how_to_implement = You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. -annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} known_false_positives = Unknown. This may require filtering. providing_technologies = [] @@ -6241,7 +6344,7 @@ Within the proof of concept code, the following error will occur - "The print sp The analytic is based on file path and failure to load the plug-in. \ During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. how_to_implement = You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. -annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} known_false_positives = False positives are unknown and filtering may be required. providing_technologies = [] @@ -6251,7 +6354,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. -annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 7", "CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "Initial Access"}], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566", "T1566.002"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = This detection should yield little or no false positive results. It is uncommon for LNK files to be executed from temporary or user directories. providing_technologies = [] @@ -6261,7 +6364,7 @@ asset_type = confidence = medium explanation = This detection is to identify a suspicious process that tries to delete the process file path related to its process. This technique is known to be defense evasion once a certain condition of malware is satisfied or not. Clop ransomware use this technique where it will try to delete its process file path using a .bat command if the keyboard layout is not the layout it tries to infect. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Clop Ransomware", "Remcos"], "confidence": 100, "context": ["source:endpoint", {"stage": "Credential Access"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070"]} known_false_positives = unknown providing_technologies = [] @@ -6271,7 +6374,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies `WmiPrvSE.exe` spawning a process. This typically occurs when a process is instantiated from a local or remote process using `wmic.exe`. During triage, review parallel processes for suspicious behavior or commands executed. Review the process and command-line spawning from `wmiprvse.exe`. Contain and remediate the endpoint as necessary. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 70, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} known_false_positives = Although unlikely, administrators may use wmi to execute commands for legitimate purposes. providing_technologies = [] @@ -6281,17 +6384,27 @@ asset_type = confidence = medium explanation = The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} known_false_positives = Unknown. providing_technologies = [] +[savedsearch://ESCU - Process Writing DynamicWrapperX - Rule] +type = detection +asset_type = +confidence = medium +explanation = DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering it into the registry is highly suspect. Why is it needed? In most malicious instances, it will be written to disk at a non-standard location. During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1559.001"]} +known_false_positives = False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default). +providing_technologies = [] + [savedsearch://ESCU - Processes Tapping Keyboard Events - Rule] type = detection asset_type = Endpoint confidence = medium explanation = This search looks for processes in an MacOS system that is tapping keyboard events in MacOS, and essentially monitoring all keystrokes made by a user. This is a common technique used by RATs to log keystrokes from a victim, although it can also be used by legitimate processes like Siri to react on human input how_to_implement = In order to properly run this search, Splunk needs to ingest data from your osquery deployed agents with the [osx-attacks.conf](https://github.com/facebook/osquery/blob/experimental/packs/osx-attacks.conf#L599) pack enabled. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the Alerts data model. -annotations = {"analytic_story": ["ColdRoot MacOS RAT"], "cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.DP"]} +annotations = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.DP"]} known_false_positives = There might be some false positives as keyboard event taps are used by processes like Siri and Zoom video chat, for some good examples of processes to exclude please see [this](https://github.com/facebook/osquery/pull/5345#issuecomment-454639161) comment. providing_technologies = [] @@ -6301,7 +6414,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for processes launching netsh.exe to execute various commands via the netsh command-line utility. Netsh.exe is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper .dll when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe that are executing commands via the command line. Deprecated because we have another detection of the same type. how_to_implement = To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Netsh Abuse"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It is unusual for netsh.exe to have any child processes in most environments. It makes sense to investigate the child process and verify whether the process spawned is legitimate. We explicitely exclude "C:\Program Files\rempl\sedlauncher.exe" process path since it is a legitimate process by Mircosoft. providing_technologies = [] @@ -6311,7 +6424,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 70, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands. providing_technologies = [] @@ -6321,7 +6434,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for network traffic defined by port and transport layer protocol in the Enterprise Security lookup table "lookup_interesting_ports", that is marked as prohibited, and has an associated 'allow' action in the Network_Traffic data model. This could be indicative of a misconfigured network device. how_to_implement = In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated. -annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "PR.AC"]} +annotations = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "PR.AC"]} known_false_positives = None identified providing_technologies = [] @@ -6331,7 +6444,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for applications on the endpoint that you have marked as prohibited. how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. In addition, you must also have only the `process_name` (not the entire process path) marked as "prohibited" in the Enterprise Security `interesting processes` table. To include the process names marked as "prohibited", which is included with ES Content Updates, run the included search Add Prohibited Processes to Enterprise Security. -annotations = {"analytic_story": ["Monitor for Unauthorized Software", "Emotet Malware DHS Report TA18-201A ", "SamSam Ransomware"], "cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} +annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = None identified providing_technologies = [] @@ -6341,7 +6454,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for network traffic on common ports where a higher layer protocol does not match the port that is being used. For example, this search should identify cases where protocols other than HTTP are running on TCP port 80. This can be used by attackers to circumvent firewall restrictions, or as an attempt to hide malicious communications over ports and protocols that are typically allowed and not well inspected. how_to_implement = Running this search properly requires a technology that can inspect network traffic and identify common protocols. Technologies such as Bro and Palo Alto Networks firewalls are two examples that will identify protocols via inspection, and not just assume a specific protocol based on the transport protocol and ports. -annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["DE.AE", "PR.AC"]} +annotations = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["DE.AE", "PR.AC"]} known_false_positives = None identified providing_technologies = [] @@ -6351,7 +6464,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies cleartext protocols at risk of leaking sensitive information. Currently, this consists of legacy protocols such as telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP (port 21) sessions. While some of these protocols may be used over SSL, they typically are found on different assigned ports in those instances. how_to_implement = This search requires you to be ingesting your network traffic, and populating the Network_Traffic data model. For more accurate result it's better to limit destination to organization private and public IP range, like All_Traffic.dest IN(192.168.0.0/16,172.16.0.0/12,10.0.0.0/8, x.x.x.x/22) -annotations = {"analytic_story": ["Use of Cleartext Protocols"], "cis20": ["CIS 9", "CIS 14"], "kill_chain_phases": ["Reconnaissance", "Actions on Objectives"], "nist": ["PR.PT", "DE.AE", "PR.AC", "PR.DS"]} +annotations = {"cis20": ["CIS 9", "CIS 14"], "kill_chain_phases": ["Reconnaissance", "Actions on Objectives"], "nist": ["PR.PT", "DE.AE", "PR.AC", "PR.DS"]} known_false_positives = Some networks may use kerberized FTP or telnet servers, however, this is rare. providing_technologies = [] @@ -6361,7 +6474,7 @@ asset_type = confidence = medium explanation = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. -annotations = {"analytic_story": ["Clop Ransomware", "DarkSide Ransomware", "BlackMatter Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 90, "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"]} known_false_positives = unknown providing_technologies = [] @@ -6371,7 +6484,7 @@ asset_type = confidence = medium explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 performing checks to identify anti-virus products installed on the endpoint. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Ransomware", "Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Reconnaissance"}], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} known_false_positives = network administrator may used this command for checking purposes providing_technologies = [] @@ -6381,7 +6494,7 @@ asset_type = confidence = medium explanation = The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Reconnaissance"}], "impact": 75, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} known_false_positives = network administrator may used this command for checking purposes providing_technologies = [] @@ -6391,7 +6504,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004", "T1070"]} known_false_positives = network operator may use this batch command to delete recursively a directory or files within directory providing_technologies = [] @@ -6401,7 +6514,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks for reg.exe modifying registry keys that define Windows services and their configurations. how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -annotations = {"analytic_story": ["Windows Service Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 60, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation", "Defense Evasion"], "impact": 75, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011", "T1574"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} known_false_positives = It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate. providing_technologies = [] @@ -6411,7 +6524,7 @@ asset_type = confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for command-line arguments used to hide a file or directory using the reg add command. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1564.001"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1564.001"], "nist": ["DE.CM"]} known_false_positives = None at the moment providing_technologies = [] @@ -6421,7 +6534,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks for modifications to registry keys that can be used to launch an application or service at system startup. how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A ", "IcedID", "Remcos"], "cis20": ["CIS 8"], "confidence": 95, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001"], "nist": ["PR.PT", "DE.CM", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} known_false_positives = There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task. providing_technologies = [] @@ -6431,7 +6544,7 @@ asset_type = confidence = medium explanation = This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -annotations = {"analytic_story": ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"], "cis20": ["CIS 8"], "confidence": 95, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012", "T1546"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task. providing_technologies = [] @@ -6441,17 +6554,37 @@ asset_type = Endpoint confidence = medium explanation = This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. how_to_implement = To successfully implement this search, you must populate the Change_Analysis data model. This is typically populated via endpoint detection and response product, such as Carbon Black or other endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications providing_technologies = [] +[savedsearch://ESCU - Regsvr32 Silent Param Dll Loading - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]} +known_false_positives = Other third part application may used this parameter but not so common in base windows environment. +providing_technologies = [] + [savedsearch://ESCU - Remcos RAT File Creation in Remcos Folder - Rule] type = detection asset_type = confidence = medium explanation = This search is to detect file creation in remcos folder in appdata which is the keylog and clipboard logs that will be send to its c2 server. This is really a good TTP indicator that there is a remcos rat in the system that do keylogging, clipboard grabbing and audio recording. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Remcos"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Remcos client registry install entry - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search detects registry key license at host where Remcos RAT agent is installed. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} known_false_positives = unknown providing_technologies = [] @@ -6461,7 +6594,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for RDP application network traffic and filters any source/destination pair generating more than twice the standard deviation of the average traffic. how_to_implement = You must ensure that your network traffic data is populating the Network_Traffic data model. -annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware"], "cis20": ["CIS 12", "CIS 9", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Delivery"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +annotations = {"cis20": ["CIS 12", "CIS 9", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Delivery"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} known_false_positives = RDP gateways may have unusually high amounts of traffic from all other hosts' RDP applications in the network. providing_technologies = [] @@ -6471,7 +6604,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for network traffic on TCP/3389, the default port used by remote desktop. While remote desktop traffic is not uncommon on a network, it is usually associated with known hosts. This search will ignore common RDP sources and common RDP destinations so you can focus on the uncommon uses of remote desktop on your network. how_to_implement = To successfully implement this search you need to identify systems that commonly originate remote desktop traffic and that commonly receive remote desktop traffic. You can use the included support search "Identify Systems Creating Remote Desktop Traffic" to identify systems that originate the traffic and the search "Identify Systems Receiving Remote Desktop Traffic" to identify systems that receive a lot of remote desktop traffic. After identifying these systems, you will need to add the "common_rdp_source" or "common_rdp_destination" category to that system depending on the usage, using the Enterprise Security Assets and Identities framework. This can be done by adding an entry in the assets.csv file located in SA-IdentityManagement/lookups. -annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Lateral Movement"], "cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +annotations = {"cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} known_false_positives = Remote Desktop may be used legitimately by users on the network. providing_technologies = [] @@ -6481,7 +6614,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for the remote desktop process mstsc.exe running on systems upon which it doesn't typically run. This is accomplished by filtering out all systems that are noted in the `common_rdp_source category` in the Assets and Identity framework. how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. The search requires you to identify systems that do not commonly use remote desktop. You can use the included support search "Identify Systems Using Remote Desktop" to identify these systems. After identifying them, you will need to add the "common_rdp_source" category to that system using the Enterprise Security Assets and Identities framework. This can be done by adding an entry in the assets.csv file located in `SA-IdentityManagement/lookups`. -annotations = {"analytic_story": ["Hidden Cobra Malware", "Lateral Movement"], "cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +annotations = {"cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} known_false_positives = Remote Desktop may be used legitimately by users on the network. providing_technologies = [] @@ -6491,7 +6624,7 @@ asset_type = Endpoint confidence = medium explanation = This analytic identifies wmic.exe being launched with parameters to spawn a process on a remote system. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Ransomware", "Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 70, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} known_false_positives = The wmic.exe utility is a benign Windows application. It may be used legitimately by Administrators with these parameters for remote system administration, but it's relatively uncommon. providing_technologies = [] @@ -6501,7 +6634,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search monitors for remote modifications to registry keys. how_to_implement = To successfully implement this search, you must populate the `Endpoint` data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. Deprecated because I don't think the logic is right. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = This technique may be legitimately used by administrators to modify remote registries, so it's important to filter these events out. providing_technologies = [] @@ -6511,7 +6644,7 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use Adsisearcher for troubleshooting. providing_technologies = [] @@ -6521,7 +6654,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover remote systems. The `computer` argument returns a list of all computers registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -6531,7 +6664,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to discover remote systems. The argument `domain computers /domain` returns a list of all domain computers. Red Teams and adversaries alike use net.exe to identify remote systems for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -6541,7 +6674,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command return a list of all the systems registered in the domain. Red Teams and adversaries alike may leverage WMI and wmic.exe to identify remote systems for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -6551,7 +6684,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. During triage, review parallel processes for additional commands executed. Look for any file modifications before and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm execution or file modifications. Contain and isolate the endpoint as needed. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. Deprecated because duplicate of Remote Process Instantiation via WMI. -annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 60, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} known_false_positives = Administrators may use this legitimately to gather info from remote systems. Filter as needed. providing_technologies = [] @@ -6561,7 +6694,7 @@ asset_type = confidence = medium explanation = The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive team. one example of ransomware that use this technique is CLOP ransomware where it drops a .bat file that will resize the shadowstorage to minimum size as much as possible how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = network admin can resize the shadowstorage for valid purposes. providing_technologies = [] @@ -6571,7 +6704,7 @@ asset_type = confidence = medium explanation = This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} known_false_positives = third party tool may have same command line parameters as revil ransomware. providing_technologies = [] @@ -6581,7 +6714,7 @@ asset_type = confidence = medium explanation = This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. how_to_implement = to successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} known_false_positives = unknown providing_technologies = [] @@ -6591,7 +6724,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 8"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = While not common, loading a DLL under %AppData% and calling a function by ordinal is possible by a legitimate process providing_technologies = [] @@ -6601,7 +6734,7 @@ asset_type = confidence = medium explanation = The following hunting detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. \ This is written to be a bit more broad by not including .cpl. \ During triage, review parallel processes to identify any further suspicious behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} known_false_positives = This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment. providing_technologies = [] @@ -6611,7 +6744,7 @@ asset_type = confidence = medium explanation = The following detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type from windows\temp, programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. This is written to be a bit more broad by not including .cpl. The paths are specified, add more as needed. During triage, review parallel processes to identify any further suspicious behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} known_false_positives = This may be tuned, or a new one related, by adding .cpl to command-line. However, it's important to look for both. Tune/filter as needed. providing_technologies = [] @@ -6621,7 +6754,7 @@ asset_type = confidence = medium explanation = This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to cmd.exe process. This technique was seen in IcedID malware to execute its malicious code in normal process for defense evasion and to steal sensitive information the the compromised host. browser process. how_to_implement = To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = unknown providing_technologies = [] @@ -6631,7 +6764,7 @@ asset_type = confidence = medium explanation = This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID malware where it hooks the browser to parse banking information as user used the targetted browser process. how_to_implement = To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = unknown providing_technologies = [] @@ -6641,7 +6774,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious rundll32.exe process having a http connection and do a dns query in some web domain. This technique was seen in IcedID malware where the rundll32 that execute its payload will contact amazon.com to check internet connect and to communicate to its C&C server to download config and other file component. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} known_false_positives = unknown providing_technologies = [] @@ -6651,7 +6784,17 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable drop it either appdata or programdata as part of its execution. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and eventcode 11 executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Rundll32 Shimcache Flush - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a suspicious rundll32 commandline to clear shim cache. This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} known_false_positives = unknown providing_technologies = [] @@ -6661,7 +6804,7 @@ asset_type = confidence = medium explanation = The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "processname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. providing_technologies = [] @@ -6671,7 +6814,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation. how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint Filesystem data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. -annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = If there are files with this keywoord as file names it might trigger false possitives, please make use of our filters to tune out potential FPs. providing_technologies = [] @@ -6681,7 +6824,7 @@ asset_type = confidence = medium explanation = This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This is a high fidelity indicator of Ryuk ransomware executing on an endpoint. Upon triage, isolate the endpoint. Additional file modification events will be within the users profile (\appdata\roaming) and in public directories (users\public\). Review all Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Ryuk Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1059.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1059", "T1059.003"]} known_false_positives = Limited to no known false positives. providing_technologies = [] @@ -6691,7 +6834,7 @@ asset_type = confidence = medium explanation = The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords. how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}, {"name": "Object_Name", "role": ["Other"], "type": "File"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]} known_false_positives = Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`. providing_technologies = [] @@ -6701,7 +6844,7 @@ asset_type = confidence = medium explanation = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} known_false_positives = Limited false positives should be present as this is not commonly used by legitimate applications. providing_technologies = [] @@ -6711,7 +6854,7 @@ asset_type = confidence = medium explanation = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} known_false_positives = Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring. providing_technologies = [] @@ -6721,7 +6864,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for spikes in the number of Server Message Block (SMB) traffic connections. how_to_implement = This search requires you to be ingesting your network traffic logs and populating the `Network_Traffic` data model. -annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002", "T1021"], "nist": ["DE.CM"]} known_false_positives = A file server may experience high-demand loads that could cause this analytic to trigger. providing_technologies = [] @@ -6734,7 +6877,7 @@ how_to_implement = To successfully implement this search, you will need to ensur This search produces a field (Number of events,count) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. This field contributes additional context to the notable. To see the additional metadata, add the following field, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry): \ 1. **Label:** Number of events, **Field:** count\ Detailed documentation on how to create a new field within Incident Review is found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` -annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002", "T1021"], "nist": ["DE.CM"]} known_false_positives = If you are seeing more results than desired, you may consider reducing the value of the threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data. Please update the `smb_traffic_spike_mltk_filter` macro to filter out false positive results providing_technologies = [] @@ -6744,7 +6887,7 @@ asset_type = Database Server confidence = medium explanation = This search looks for long URLs that have several SQL commands visible within them. how_to_implement = To successfully implement this search, you need to be monitoring network communications to your web servers or ingesting your HTTP logs and populating the Web data model. You must also identify your web servers in the Enterprise Security assets table. -annotations = {"analytic_story": ["SQL Injection"], "cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]} +annotations = {"cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]} known_false_positives = It's possible that legitimate traffic will have long URLs or long user agent strings and that common SQL commands may be found within the URL. Please investigate as appropriate. providing_technologies = [] @@ -6754,7 +6897,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks for a file named "test.txt" written to the windows system directory tree, which is consistent with Samsam propagation. how_to_implement = You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. -annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 20, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 60, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = No false positives have been identified. providing_technologies = [] @@ -6764,7 +6907,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for arguments to sc.exe indicating the creation or modification of a Windows service. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003", "T1543"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} known_false_positives = Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate. providing_technologies = [] @@ -6774,7 +6917,7 @@ asset_type = confidence = medium explanation = This analytic is to detect an application try to connect and create ADSI Object to do LDAP query. Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. If it has changed since the last connection, the schema is downloaded and stored in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious application like blackmatter ransomware that use ADS object api to execute ldap query. having a good list of ldap or normal AD query tool used within the network is a good start to reduce the noise. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["blackMatter ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002", "T1087"]} known_false_positives = normal application like mmc.exe and other ldap query tool may trigger this detections. providing_technologies = [] @@ -6784,7 +6927,7 @@ asset_type = confidence = medium explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. -annotations = {"analytic_story": ["Windows Persistence Techniques"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Arguments", "role": ["Attacker"], "type": "Arguments"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} known_false_positives = unknown providing_technologies = [] @@ -6794,7 +6937,7 @@ asset_type = confidence = medium explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. -annotations = {"analytic_story": ["Windows Persistence Techniques", "Trickbot", "IcedID"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Arguments", "role": ["Attacker"], "type": "Arguments"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} known_false_positives = unknown providing_technologies = [] @@ -6804,7 +6947,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for flags passed to schtasks.exe on the command-line that indicate a task was created via command like. This has been associated with the Dragonfly threat actor, and the SUNBURST attack against Solarwinds. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 3"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"]} known_false_positives = Tasks should not be manually created via CLI, this is rarely done by admins as well providing_technologies = [] @@ -6814,7 +6957,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware were created or deleted. Deprecated because we already have a similar detection how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Ransomware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} +annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} known_false_positives = No known false positives providing_technologies = [] @@ -6824,7 +6967,7 @@ asset_type = confidence = medium explanation = This analytic identifies an on demand run of a Windows Schedule Task through shell or command-line. This technique has been used by adversaries that force to run their created Schedule Task as their persistence mechanism or for lateral movement as part of their malicious attack to the compromised machine. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed schtasks.exe may be used. -annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} known_false_positives = Administrators may use to debug Schedule Task entries. Filter as needed. providing_technologies = [] @@ -6834,7 +6977,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for flags passed to schtasks.exe on the command-line that indicate a job is being scheduled on a remote system. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Lateral Movement", "NOBELIUM Group"], "cis20": ["CIS 3"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"]} known_false_positives = Administrators may create jobs on remote systems, but this activity is usually limited to a small set of hosts or users. It is important to validate and investigate as appropriate. providing_technologies = [] @@ -6844,17 +6987,27 @@ asset_type = Endpoint confidence = medium explanation = This search looks for flags passed to schtasks.exe on the command-line that indicate that a forced reboot of system is scheduled. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware"], "cis20": ["CIS 3"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"]} known_false_positives = Administrators may create jobs on systems forcing reboots to perform updates, maintenance, etc. providing_technologies = [] +[savedsearch://ESCU - Screensaver Event Trigger Execution - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546", "T1546.002"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Script Execution via WMI - Rule] type = detection asset_type = Endpoint confidence = medium explanation = This search looks for scripts launched via WMI. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 60, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} known_false_positives = Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed. providing_technologies = [] @@ -6864,17 +7017,27 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} known_false_positives = Limited to no false positives are expected. providing_technologies = [] +[savedsearch://ESCU - Sdelete Application Execution - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect the execution of sdelete.exe application sysinternal tools. This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user execute this application which is not a common practice. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"]} +known_false_positives = user may execute and use this application +providing_technologies = [] + [savedsearch://ESCU - SearchProtocolHost with no Command Line with Network - Rule] type = detection asset_type = confidence = medium explanation = The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. -annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}, "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "processname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. providing_technologies = [] @@ -6884,7 +7047,7 @@ asset_type = confidence = medium explanation = This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["source:endpoint", {"stage": "Credential Access"}], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003", "T1003"]} known_false_positives = unknown providing_technologies = [] @@ -6894,7 +7057,7 @@ asset_type = confidence = medium explanation = The following analytic identifies the use of `svc-exe` with Cobalt Strike. The behavior typically follows after an adversary has already gained initial access and is escalating privileges. Using `svc-exe`, a randomly named binary will be downloaded from the remote Teamserver and placed on disk within `C:\Windows\400619a.exe`. Following, the binary will be added to the registry under key `HKLM\System\CurrentControlSet\Services\400619a\` with multiple keys and values added to look like a legitimate service. Upon loading, `services.exe` will spawn the randomly named binary from `\\127.0.0.1\ADMIN$\400619a.exe`. The process lineage is completed with `400619a.exe` spawning rundll32.exe, which is the default `spawnto_` value for Cobalt Strike. The `spawnto_` value is arbitrary and may be any process on disk (typically system32/syswow64 binary). The `spawnto_` process will also contain a network connection. During triage, review parallel procesess and identify any additional file modifications. how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. -annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 95, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "user"}]} +annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548"]} known_false_positives = False positives should be limited as `services.exe` should never spawn a process from `ADMIN$`. Filter as needed. providing_technologies = [] @@ -6904,7 +7067,7 @@ asset_type = Endpoint confidence = medium explanation = Monitor for changes of the ExecutionPolicy in the registry to the values "unrestricted" or "bypass," which allows the execution of malicious scripts. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Registry node. You must also be ingesting logs with the fields registry_path, registry_key_name, and registry_value_name from your endpoints. -annotations = {"analytic_story": ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "registry_path", "role": ["Others"], "type": "RegistryPath"}]} +annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["DE.CM"]} known_false_positives = Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should be reviewed and investigated as appropriate. providing_technologies = [] @@ -6914,7 +7077,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. -annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Others"], "type": "file path"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["DE.CM"]} known_false_positives = Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation. providing_technologies = [] @@ -6924,7 +7087,7 @@ asset_type = Endpoint confidence = medium explanation = This search detects the process execution and arguments required to silently create a shim database. The sdbinst.exe application is used to install shim database files (.sdb). A shim is a small library which transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["DE.CM"]} known_false_positives = None identified providing_technologies = [] @@ -6934,7 +7097,7 @@ asset_type = Windows confidence = medium explanation = This search detects accounts that were created and deleted in a short time period. how_to_implement = This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs. More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/ -annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 90, "context": ["source:endpoint", {"stage": "Persistence"}], "impact": 70, "mitre_attack": ["T1136.001"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.IP"]} known_false_positives = It is possible that an administrator created and deleted an account in a short time period. Verifying activity with an administrator is advised. providing_technologies = [] @@ -6944,7 +7107,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} known_false_positives = unknown providing_technologies = [] @@ -6954,7 +7117,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for process names that consist only of a single letter. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 2"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204", "T1204.002"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = Single-letter executables are not always malicious. Investigate this activity with your normal incident-response process. providing_technologies = [] @@ -6964,7 +7127,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities. how_to_implement = The search requires that you are ingesting your vulnerability-scanner data and that it reports the CVE of the vulnerability identified. -annotations = {"analytic_story": ["Spectre And Meltdown Vulnerabilities"], "cis20": ["CIS 4"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]} +annotations = {"cis20": ["CIS 4"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]} known_false_positives = It is possible that your vulnerability scanner is not detecting that the patches have been applied. providing_technologies = [] @@ -6974,7 +7137,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks for a sharp increase in the number of files written to a particular host how_to_implement = In order to implement this search, you must populate the Endpoint file-system data model node. This is typically populated via endpoint detection and response product, such as Carbon Black or endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the file system. -annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]} known_false_positives = It is important to understand that if you happen to install any new applications on your hosts or are copying a large number of files, you can expect to see a large increase of file modifications. providing_technologies = [] @@ -6984,7 +7147,7 @@ asset_type = Splunk Server confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug. how_to_implement = The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Whitelisting your Splunk systems will reduce false positives. -annotations = {"analytic_story": ["Splunk Enterprise Vulnerability CVE-2018-11409"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} +annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} known_false_positives = Retrieving server information may be a legitimate API request. Verify that the attempt is a valid request for information. providing_technologies = [] @@ -6994,7 +7157,7 @@ asset_type = confidence = medium explanation = The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} known_false_positives = Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver. providing_technologies = [] @@ -7004,7 +7167,7 @@ asset_type = confidence = medium explanation = This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "ImageLoaded", "role": ["Other"], "type": "File"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} known_false_positives = unknown providing_technologies = [] @@ -7014,7 +7177,7 @@ asset_type = confidence = medium explanation = This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack. how_to_implement = To successfully implement this search, you need to be ingesting logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe. -annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ProcessID", "role": ["Parent Process"], "type": "Process"}, {"name": "TargetImage", "role": ["Target"], "type": "Process Name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"]} known_false_positives = Unknown. Filter as needed. providing_technologies = [] @@ -7024,7 +7187,7 @@ asset_type = confidence = medium explanation = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. -annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} known_false_positives = Unknown. providing_technologies = [] @@ -7034,7 +7197,7 @@ asset_type = confidence = medium explanation = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} known_false_positives = Limited false positives. Filter as needed. providing_technologies = [] @@ -7044,7 +7207,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious file creation of sqlite3.dll in %temp% folder. This behavior was seen in IcedID malware where it download sqlite module to parse browser database like for chrome or firefox to stole browser information related to bank, credit card or credentials. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["IcedID"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1005"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1005"]} known_false_positives = unknown providing_technologies = [] @@ -7054,7 +7217,7 @@ asset_type = confidence = medium explanation = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"]} known_false_positives = updated windows application needed in safe boot may used this registry providing_technologies = [] @@ -7064,7 +7227,7 @@ asset_type = Windows confidence = medium explanation = The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost.exe. After a period of 12-14 days, the malware will attempt to resolve a subdomain of avsvmcloud.com. This detections will correlate both events. how_to_implement = This detection relies on sysmon logs with the Event ID 7, Driver loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. We suggest to run this detection at least once a day over the last 14 days. -annotations = {"analytic_story": ["NOBELIUM Group"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} known_false_positives = unknown providing_technologies = [] @@ -7074,7 +7237,7 @@ asset_type = confidence = medium explanation = This search aims to detect the Supernova webshell used in the SUNBURST attack. how_to_implement = To successfully implement this search, you need to be monitoring web traffic to your Solarwinds Orion. The logs should be ingested into splunk and populating/mapped to the Web data model. -annotations = {"analytic_story": ["NOBELIUM Group"], "cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1505.003"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]} +annotations = {"cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1505.003"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]} known_false_positives = There might be false positives associted with this detection since items like args as a web argument is pretty generic. providing_technologies = [] @@ -7084,17 +7247,27 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area. how_to_implement = To successfully implement this search you need to be ingesting information on registry changes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` nodes. -annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows File Extension and Association Abuse"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} +annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} known_false_positives = There may be other processes in your environment that users may legitimately use to modify file associations. If this is the case and you are finding false positives, you can modify the search to add those processes as exceptions. providing_technologies = [] +[savedsearch://ESCU - Suspicious Copy on System32 - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036.003", "T1036"]} +known_false_positives = every user may do this event but very un-ussual. +providing_technologies = [] + [savedsearch://ESCU - Suspicious Curl Network Connection - Rule] type = detection asset_type = Endpoint confidence = medium explanation = The following analytic identifies the use of a curl contacting suspicious remote domains to checkin to command and control servers or download further implants. In the context of Silver Sparrow, curl is identified contacting s3.amazonaws.com. This particular behavior is common with MacOS adware-malicious software. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Silver Sparrow", "Ingress Tool Transfer"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1105"]} +annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1105"]} known_false_positives = Unknown. Filter as needed. providing_technologies = [] @@ -7104,7 +7277,7 @@ asset_type = confidence = medium explanation = The following analytic identifies DLLHost.exe with no command line arguments. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. providing_technologies = [] @@ -7114,7 +7287,7 @@ asset_type = confidence = medium explanation = This analytic will detect suspicious driver loaded paths. This technique is commonly used by malicious software like coin miners (xmrig) to register its malicious driver from notable directories where executable or drivers do not commonly exist. During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review. how_to_implement = To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["XMRig"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "File Name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003", "T1543"]} known_false_positives = Limited false positives will be present. Some applications do load drivers providing_technologies = [] @@ -7124,7 +7297,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This detection looks for emails that are suspicious because of their sender, domain rareness, or behavior differences. This is an anomaly generated by Splunk User Behavior Analytics (UBA). how_to_implement = You must be ingesting data from email logs and have Splunk integrated with UBA. This anomaly is raised by a UBA detection model called "SuspiciousEmailDetectionModel." Ensure that this model is enabled on your UBA instance. -annotations = {"analytic_story": ["Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566"], "nist": ["PR.IP"]} +annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566"], "nist": ["PR.IP"]} known_false_positives = This detection model will alert on any sender domain that is seen for the first time. This could be a potential false positive. The next step is to investigate and add the URL to an allow list if you determine that it is a legitimate sender. providing_technologies = [] @@ -7136,7 +7309,7 @@ explanation = This search looks for emails that have attachments with suspicious how_to_implement = You need to ingest data from emails. Specifically, the sender's address and the file names of any attachments must be mapped to the Email data model. \ **Splunk Phantom Playbook Integration**\ If Splunk Phantom is also configured in your environment, a Playbook called "Suspicious Email Attachment Investigate and Delete" can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, and add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search. The notable event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user's inbox. -annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"], "cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001"], "nist": ["DE.AE", "PR.IP"]} +annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566"], "nist": ["DE.AE", "PR.IP"]} known_false_positives = None identified providing_technologies = [] @@ -7146,7 +7319,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic utilizes Windows Event ID 1100 to identify when Windows event log service is shutdown. Note that this is a voluminous analytic that will require tuning or restricted to specific endpoints based on criticality. This event generates every time Windows Event Log service has shut down. It also generates during normal system shutdown. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. -annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]} known_false_positives = It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. Filter as needed. providing_technologies = [] @@ -7156,7 +7329,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for files created with names that have been linked to malicious activity. how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor. -annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It's possible for a legitimate file to be created with the same name as one noted in the lookup file. Filenames listed in the lookup file should be unique enough that collisions are rare. Looking at the location of the file and the process responsible for the activity can help determine whether or not the activity is legitimate. providing_technologies = [] @@ -7166,7 +7339,7 @@ asset_type = confidence = medium explanation = The following analytic identifies gpupdate.exe with no command line arguments. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. providing_technologies = [] @@ -7176,7 +7349,7 @@ asset_type = confidence = medium explanation = this search is to detect a suspicious regsvr32 commandline "-s" to execute a dll files. This technique was seen in IcedID malware to execute its initial downloader dll that will download the 2nd stage loader that will download and decrypt the config payload. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.010"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]} known_false_positives = minimal. but network operator can use this application to load dll. providing_technologies = [] @@ -7186,7 +7359,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious rundll32.exe commandline to execute dll file. This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted dll payload which is the license.dat. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} known_false_positives = limitted. this parameter is not commonly used by windows application but can be used by the network operator. providing_technologies = [] @@ -7196,7 +7369,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious creation of image in appdata folder made by process that also has a file reference in appdata folder. This technique was seen in remcos rat that capture screenshot of the compromised machine and place it in the appdata and will be send to its C2 server. This TTP is really a good indicator to check that process because it is in suspicious folder path and image files are not commonly created by user in this folder path. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Remcos"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"]} known_false_positives = unknown providing_technologies = [] @@ -7206,7 +7379,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for suspicious Java classes that are often used to exploit remote command execution in common Java frameworks, such as Apache Struts. how_to_implement = In order to properly run this search, Splunk needs to ingest data from your web-traffic appliances that serve or sit in the path of your Struts application servers. This can be accomplished by indexing data from a web proxy, or by using network traffic-analysis tools, such as Splunk Stream or Bro. -annotations = {"analytic_story": ["Apache Struts Vulnerability"], "cis20": ["CIS 7", "CIS 12"], "kill_chain_phases": ["Exploitation"], "nist": ["DE.AE"]} +annotations = {"cis20": ["CIS 7", "CIS 12"], "kill_chain_phases": ["Exploitation"], "nist": ["DE.AE"]} known_false_positives = There are no known false positives. providing_technologies = [] @@ -7216,7 +7389,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies renamed instances of msbuild.exe executing. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the code executed and what is executing a renamed instance of MSBuild. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may use a moved copy of msbuild, triggering a false positive. providing_technologies = [] @@ -7226,7 +7399,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In this instance, there will be command line arguments and file paths. In a malicious instance, MSBuild.exe will spawn from non-standard processes and have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should be investigated. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1127.001"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive. providing_technologies = [] @@ -7243,7 +7416,7 @@ explanation = The following analytic identifies the use of a native MacOS utilit - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \ Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Silver Sparrow"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001"]} +annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001", "T1543"]} known_false_positives = Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm. providing_technologies = [] @@ -7260,7 +7433,7 @@ explanation = The following analytic identifies the use of a native MacOS utilit - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \ Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further. how_to_implement = OSQuery must be installed and configured to pick up process events (info at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402. Modify the macro and validate fields are correct. -annotations = {"analytic_story": ["Silver Sparrow"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001"]} +annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001", "T1543"]} known_false_positives = Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm. providing_technologies = [] @@ -7270,7 +7443,7 @@ asset_type = confidence = medium explanation = The following analytic will detect a suspicious process running in a file path where a process is not commonly seen and is most commonly used by malicious softtware. This behavior has been used by adversaries where they drop and run an exe in a path that is accessible without admin privileges. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["XMRig", "Remcos"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"]} known_false_positives = Administrators may allow execution of specific binaries in non-standard paths. Filter as needed. providing_technologies = [] @@ -7280,7 +7453,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for reg.exe being launched from a command prompt not started by the user. When a user launches cmd.exe, the parent process is usually explorer.exe. This search filters out those instances. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]} known_false_positives = It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out. providing_technologies = [] @@ -7290,7 +7463,7 @@ asset_type = Endpoint confidence = medium explanation = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using non-standard file extensions to load malciious DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review additional parrallel processes and child processes for additional activity. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Tune the query by filtering additional extensions found to be used by legitimate processes. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Iceid"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"]} known_false_positives = Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues. providing_technologies = [] @@ -7300,7 +7473,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["IcedID"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} known_false_positives = third party application may used this dll export name to execute function. providing_technologies = [] @@ -7310,7 +7483,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe executing and what script content it is loading. This query relies on the original filename or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1036", "T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. providing_technologies = [] @@ -7320,7 +7493,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of Cobalt Strike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed. providing_technologies = [] @@ -7330,7 +7503,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer method entry point in the DLL is invoked. This is typically seen when a DLL is being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it. During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = This is likely to produce false positives and will require some filtering. Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names. providing_technologies = [] @@ -7340,7 +7513,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. providing_technologies = [] @@ -7350,7 +7523,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies the use of a SQLite3 querying the MacOS preferences to identify the original URL the pkg was downloaded from. This particular behavior is common with MacOS adware-malicious software. Upon triage, review other processes in parallel for suspicious activity. Identify any recent package installations. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Silver Sparrow"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1074"]} +annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1074"]} known_false_positives = Unknown. providing_technologies = [] @@ -7360,7 +7533,7 @@ asset_type = confidence = medium explanation = The following detection identifies Scheduled Tasks registering (creating a new task) a binary or script to run from a public directory which includes users\public, \programdata\ and \windows\temp. Upon triage, review the binary or script in the command line for legitimacy, whether an approved binary/script or not. In addition, capture the binary or script in question and analyze for further behaviors. Identify the source and contain the endpoint. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1053.005", "T1053"]} known_false_positives = Limited false positives may be present. Filter as needed by parent process or command line argument. providing_technologies = [] @@ -7370,7 +7543,7 @@ asset_type = confidence = medium explanation = The following analytic identifies searchprotocolhost.exe with no command line arguments. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. providing_technologies = [] @@ -7380,7 +7553,7 @@ asset_type = confidence = medium explanation = This analytic is to detect a suspicious creation of .wav file in appdata folder. This behavior was seen in Remcos RAT malware where it put the audio recording in the appdata\audio folde as part of data collection. this recording can be send to its C2 server as part of its exfiltration to the compromised machine. creation of wav files in this folder path is not a ussual disk place used by user to save audio format file. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Remcos"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"]} known_false_positives = unknown providing_technologies = [] @@ -7390,7 +7563,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe. Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. A spawned child process from microsoft.workflow.compiler.exe is uncommon. In any instance, microsoft.workflow.compiler.exe spawning from an Office product or any living off the land binary is highly suspect. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may use a moved copy of microsoft.workflow.compiler.exe, triggering a false positive. providing_technologies = [] @@ -7400,7 +7573,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies microsoft.workflow.compiler.exe usage. microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. It is not a commonly used process by many applications. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, limited instances have been identified coming from native Microsoft utilities similar to SCCM. providing_technologies = [] @@ -7410,7 +7583,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies msbuild.exe executing from a non-standard path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio will run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however there are instances of build applications that will move or use a copy of MSBuild. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Some legitimate applications may use a moved copy of msbuild.exe, triggering a false positive. Baselining of MSBuild.exe usage is recommended to better understand it's path usage. Visual Studio runs an instance out of a path that will need to be filtered on. providing_technologies = [] @@ -7420,7 +7593,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies child processes spawning from "mshta.exe". The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process "mshta.exe" and its child process. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Process Name"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive. providing_technologies = [] @@ -7430,7 +7603,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn mshta.exe from svchost.exe. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive. providing_technologies = [] @@ -7438,9 +7611,9 @@ providing_technologies = [] type = detection asset_type = confidence = medium -explanation = The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, or system event logs. +explanation = The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, trace or system event logs. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001", "T1070"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"]} known_false_positives = The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. providing_technologies = [] @@ -7450,7 +7623,7 @@ asset_type = Windows confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search detects writes to the 'System Volume Information' folder by something other than the System process. how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]} known_false_positives = It is possible that other utilities or system processes may legitimately write to this folder. Investigate and modify the search to include exceptions as appropriate. providing_technologies = [] @@ -7460,7 +7633,7 @@ asset_type = Windows confidence = medium explanation = This search detects writes to the recycle bin by a process other than explorer.exe. how_to_implement = To successfully implement this search you need to be ingesting information on filesystem and process logs responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes. -annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "mitre_attack": ["T1036"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]} known_false_positives = Because the Recycle Bin is a hidden folder in modern versions of Windows, it would be unusual for a process other than explorer.exe to write to it. Incidents should be investigated as appropriate. providing_technologies = [] @@ -7470,7 +7643,7 @@ asset_type = Windows confidence = medium explanation = Detect system information discovery techniques used by attackers to understand configurations of the system to further exploit it. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Discovery Techniques"], "cis20": ["CIS 6", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Recon", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Attacker"], "type": "User"}]} +annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]} known_false_positives = Administrators debugging servers providing_technologies = [] @@ -7482,7 +7655,7 @@ explanation = This search looks for system processes that typically execute from This detection utilizes a lookup that is deduped `system32` and `syswow64` directories from Server 2016 and Windows 10.\ During triage, review the parallel processes - what process moved the native Windows binary? identify any artifacts on disk and review. If a remote destination is contacted, what is the reputation? how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = This detection may require tuning based on third party applications utilizing native Windows binaries in non-standard paths. providing_technologies = [] @@ -7492,7 +7665,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `query.exe` with command-line arguments utilized to discover the logged user. Red Teams and adversaries alike may leverage `query.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -7502,7 +7675,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `whoami.exe` without any arguments. This windows native binary prints out the current logged user. Red Teams and adversaries alike may leverage `whoami.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -7512,17 +7685,27 @@ asset_type = Endpoint confidence = medium explanation = This search looks for network traffic identified as The Onion Router (TOR), a benign anonymity network which can be abused for a variety of nefarious purposes. how_to_implement = In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated. -annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control", "NOBELIUM Group"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.001"], "nist": ["DE.AE"]} +annotations = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071", "T1071.001"], "nist": ["DE.AE"]} known_false_positives = None at this time providing_technologies = [] +[savedsearch://ESCU - Time Provider Persistence Registry - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. +how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.003", "T1547"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Trickbot Named Pipe - Rule] type = detection asset_type = confidence = medium explanation = this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. . -annotations = {"analytic_story": ["Trickbot"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "Image", "role": ["Attacker"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = unknown providing_technologies = [] @@ -7532,7 +7715,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} known_false_positives = unknown. all of the dll loaded by mmc.exe is microsoft signed dll. providing_technologies = [] @@ -7542,7 +7725,7 @@ asset_type = confidence = medium explanation = This search is to detect a possible uac bypass using the colorui.dll COM Object. this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll COM CLSID to bypass UAC. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Other"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"]} known_false_positives = not so common. but 3rd part app may load this dll. providing_technologies = [] @@ -7552,7 +7735,7 @@ asset_type = Endpoint confidence = medium explanation = The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files on the disk. This search looks for fsutil.exe deleting the USN journal. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 6", "CIS 8", "CIS 10"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.CM", "PR.PT", "DE.AE", "DE.DP", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 6", "CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.CM", "PR.PT", "DE.AE", "DE.DP", "PR.IP"]} known_false_positives = None identified providing_technologies = [] @@ -7562,7 +7745,7 @@ asset_type = confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for applications on the endpoint that you have marked as uncommon. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search uses a lookup file `uncommon_processes_default.csv` to track various features of process names that are usually uncommon in most environments. Please consider updating `uncommon_processes_local.csv` to hunt for processes that are uncommon in your environment. -annotations = {"analytic_story": ["Windows Privilege Escalation", "Unusual Processes"], "cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]} +annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]} known_false_positives = None identified providing_technologies = [] @@ -7572,7 +7755,7 @@ asset_type = confidence = medium explanation = This detection identifies Microsoft Exchange Server's Unified Messaging services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe and wermgr.exe mostly due to potential false positives, however, if there is an excessive amount of "wermgr.exe" or "WerFault.exe" failures, it may be due to the active exploitation. During triage, identify any additional suspicious parallel processes. Identify any recent out of place file modifications. Review Exchange logs following Microsofts guide. To contain, perform egress filtering or restrict public access to Exchange. In final, patch the vulnerablity and monitor. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]} known_false_positives = Unknown. Tune out child processes as needed to limit volume of false positives. providing_technologies = [] @@ -7582,7 +7765,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious un-installation of application using msiexec. This technique was seen in conti leak tool and script where it tries to uninstall AV product using this commandline. This commandline to uninstall product is not a common practice in enterprise network. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Ransomware"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007", "T1218"]} known_false_positives = unknown. providing_technologies = [] @@ -7592,7 +7775,7 @@ asset_type = confidence = medium explanation = Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, update this macro to filter out false positives. -annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]} known_false_positives = providing_technologies = [] @@ -7604,7 +7787,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt{[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"]} known_false_positives = Potential for some third party applications to disable AMSI upon invocation. Filter as needed. providing_technologies = [] @@ -7614,7 +7797,7 @@ asset_type = Windows confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search detects loading of unsigned images by LSASS. Deprecated because too noisy. how_to_implement = This search needs Sysmon Logs with a sysmon configuration, which includes EventCode 7 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} known_false_positives = Other tools could load images into LSASS for legitimate reason. But enterprise tools should always use signed DLLs. providing_technologies = [] @@ -7624,7 +7807,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search gives you the hosts where a backup was attempted and then failed. how_to_implement = To successfully implement this search you need to obtain data from your backup solution, either from the backup logs on your endpoints or from a central server responsible for performing the backups. If you do not use Netbackup, you can modify this search for your specific backup solution. -annotations = {"analytic_story": ["Monitor Backup Solution"], "cis20": ["CIS 10"], "nist": ["PR.IP"]} +annotations = {"cis20": ["CIS 10"], "nist": ["PR.IP"]} known_false_positives = None identified providing_technologies = [] @@ -7634,7 +7817,7 @@ asset_type = Endpoint confidence = medium explanation = Command lines that are extremely long may be indicative of malicious activity on your hosts. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships, from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the process field in the Endpoint data model. -annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Some legitimate applications start with long command lines. providing_technologies = [] @@ -7644,7 +7827,7 @@ asset_type = confidence = medium explanation = Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Machine Learning Toolkit (MLTK) to help identify command lines with lengths that are unusual for a given user. how_to_implement = You must be ingesting endpoint data that monitors command lines and populates the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. In addition, MLTK version >= 4.2 must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of Command Line Length - MLTK" must be executed before this detection search, as it builds an ML model over the historical data used by this search. It is important that this search is run in the same app context as the associated support search, so that the model created by the support search is available for use. You should periodically re-run the support search to rebuild the model with the latest data available in your environment. -annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = Some legitimate applications use long command lines for installs or updates. You should review identified command lines for legitimacy. You may modify the first part of the search to omit legitimate command lines from consideration. If you are seeing more results than desired, you may consider changing the value of threshold in the search to a smaller value. You should also periodically re-run the support search to re-build the ML model on the latest data. You may get unexpected results if the user identified in the results is not present in the data used to build the associated model. providing_technologies = [] @@ -7654,7 +7837,7 @@ asset_type = Web Server confidence = medium explanation = This search looks for unusually long strings in the Content-Type http header that the client sends the server. how_to_implement = This particular search leverages data extracted from Stream:HTTP. You must configure the http stream using the Splunk Stream App on your Splunk Stream deployment server to extract the cs_content_type field. -annotations = {"analytic_story": ["Apache Struts Vulnerability"], "cis20": ["CIS 3", "CIS 4", "CIS 18", "CIS 12"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]} +annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18", "CIS 12"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]} known_false_positives = Very few legitimate Content-Type fields will have a length greater than 100 characters. providing_technologies = [] @@ -7664,7 +7847,7 @@ asset_type = confidence = medium explanation = This analytic looks for the execution of `powershell.exe` with command-line arguments that leverage PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -7674,17 +7857,37 @@ asset_type = confidence = medium explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the use of PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]} known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting. providing_technologies = [] +[savedsearch://ESCU - Vbscript Execution Using Wscript App - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a suspicious wscript commandline to execute vbscript. This technique was seen in several malware to execute malicious vbs file using wscript application. commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or even some av script emulation system. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005", "T1059"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Verclsid CLSID Execution - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.012", "T1218"]} +known_false_positives = windows can used this application for its normal COM object validation. +providing_technologies = [] + [savedsearch://ESCU - W3WP Spawning Shell - Rule] type = detection asset_type = confidence = medium explanation = This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, on publicly available Exchange mail servers. During triage, review the parent process and child process of the shell being spawned. Review the command-line arguments and any file modifications that may occur. Identify additional parallel process, child processes, that may highlight further commands executed. After triaging, work to contain the threat and patch the system that is vulnerable. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"]} known_false_positives = Baseline your environment before production. It is possible build systems using IIS will spawn cmd.exe to perform a software build. Filter as needed. providing_technologies = [] @@ -7694,7 +7897,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. Tune based on parent process names. -annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"]} known_false_positives = Administrators may modify the boot configuration. providing_technologies = [] @@ -7704,7 +7907,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for the creation of WMI permanent event subscriptions. how_to_implement = To successfully implement this search, you must be ingesting the Windows WMI activity logs. This can be done by adding a stanza to inputs.conf on the system generating logs with a title of [WinEventLog://Microsoft-Windows-WMI-Activity/Operational]. -annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} known_false_positives = Although unlikely, administrators may use event subscriptions for legitimate purposes. providing_technologies = [] @@ -7719,7 +7922,7 @@ All event subscriptions have three components \ 1. Binding - Registers a filter to a consumer. EventID = 21 \ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. how_to_implement = To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. -annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "host", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003", "T1546"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} known_false_positives = Although unlikely, administrators may use event subscriptions for legitimate purposes. providing_technologies = [] @@ -7729,7 +7932,7 @@ asset_type = confidence = medium explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} known_false_positives = network administrator may used this command for checking purposes providing_technologies = [] @@ -7739,7 +7942,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for the creation of WMI temporary event subscriptions. how_to_implement = To successfully implement this search, you must be ingesting the Windows WMI activity logs. This can be done by adding a stanza to inputs.conf on the system generating logs with a title of [WinEventLog://Microsoft-Windows-WMI-Activity/Operational]. -annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} known_false_positives = Some software may create WMI temporary event subscriptions for various purposes. The included search contains an exception for two of these that occur by default on Windows 10 systems. You may need to modify the search to create exceptions for other legitimate events. providing_technologies = [] @@ -7749,7 +7952,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} known_false_positives = unknown providing_technologies = [] @@ -7759,7 +7962,7 @@ asset_type = confidence = medium explanation = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"]} known_false_positives = legitimate process that are not in the exception list may trigger this event. providing_technologies = [] @@ -7769,7 +7972,7 @@ asset_type = Account confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to identify the creation of multiple user accounts using the same email domain name. how_to_implement = We start with a dataset that provides visibility into the email address used for the account creation. In this example, we are narrowing our search down to the single web page that hosts the Magento2 e-commerce platform (via URI) used for account creation, the single http content-type to grab only the user's clicks, and the http field that provides the username (form_data), for performance reasons. After we have the username and email domain, we look for numerous account creations per email domain. Common data sources used for this detection are customized Apache logs or Splunk Stream. -annotations = {"analytic_story": ["Web Fraud Detection"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136"], "nist": ["DE.CM", "DE.DP"]} +annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136"], "nist": ["DE.CM", "DE.DP"]} known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamolous behavior. This search will need to be customized to fit your environment—improving its fidelity by counting based on something much more specific, such as a device ID that may be present in your dataset. Consideration for whether the large number of registrations are occuring from a first-time seen domain may also be important. Extending the search window to look further back in time, or even calculating the average per hour/day for each email domain to look for an anomalous spikes, will improve this search. You can also use Shannon entropy or Levenshtein Distance (both courtesy of URL Toolbox) to consider the randomness or similarity of the email name or email domain, as the names are often machine-generated. providing_technologies = [] @@ -7779,7 +7982,7 @@ asset_type = account confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session. how_to_implement = Start with a dataset that allows you to see clickstream data for each user click on the website. That data must have a time stamp and must contain a reference to the session identifier being used by the website. This ties the clicks together into clickstreams. This value is usually found in the http cookie. With a bit of tuning, a version of this search could be used in high-volume scenarios, such as scraping, crawling, application DDOS, credit-card testing, account takeover, etc. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream. -annotations = {"analytic_story": ["Web Fraud Detection"], "cis20": ["CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["DE.AE", "DE.CM"]} +annotations = {"cis20": ["CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["DE.AE", "DE.CM"]} known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosly written detections that simply detect anamoluous behavior. providing_technologies = [] @@ -7789,7 +7992,7 @@ asset_type = account confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to identify user accounts that share a common password. how_to_implement = We need to start with a dataset that allows us to see the values of usernames and passwords that users are submitting to the website hosting the Magento2 e-commerce platform (commonly found in the HTTP form_data field). A tokenized or hashed value of a password is acceptable and certainly preferable to a clear-text password. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream. -annotations = {"analytic_story": ["Web Fraud Detection"], "cis20": ["CIS 16"], "nist": ["DE.DP"]} +annotations = {"cis20": ["CIS 16"], "nist": ["DE.DP"]} known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamoluous behavior. providing_technologies = [] @@ -7799,7 +8002,7 @@ asset_type = Web Server confidence = medium explanation = This search looks for suspicious processes on all systems labeled as web servers. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. In addition, web servers will need to be identified in the Assets and Identity Framework of Enterprise Security. -annotations = {"analytic_story": ["Apache Struts Vulnerability"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["PR.IP"]} +annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["PR.IP"]} known_false_positives = Some of these processes may be used legitimately on web servers during maintenance or other administrative tasks. providing_technologies = [] @@ -7809,7 +8012,7 @@ asset_type = confidence = medium explanation = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. -annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590", "T1590.005"]} known_false_positives = unknown providing_technologies = [] @@ -7819,7 +8022,7 @@ asset_type = confidence = medium explanation = this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used. -annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"]} known_false_positives = unknown providing_technologies = [] @@ -7829,7 +8032,7 @@ asset_type = confidence = medium explanation = This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} known_false_positives = unknown providing_technologies = [] @@ -7843,7 +8046,7 @@ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64 The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via TaskService. Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source. how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. -annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Command"}]} +annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005", "T1053"]} known_false_positives = False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately. providing_technologies = [] @@ -7857,7 +8060,7 @@ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64 The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source. how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. -annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Command"}]} +annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005", "T1053"]} known_false_positives = False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. providing_technologies = [] @@ -7867,7 +8070,7 @@ asset_type = confidence = medium explanation = The following analytic identifies suspicious processes spawning from WinRM (wsmprovhost.exe). This analytic is related to potential exploitation of CVE-2021-31166. which is a kernel-mode device driver http.sys vulnerability. Current proof of concept code will blue-screen the operating system. However, http.sys used by many different Windows processes, including WinRM. In this case, identifying suspicious process create (child processes) from `wsmprovhost.exe` is what this analytic is identifying. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Unusual Processes"], "kill_chain_phases": ["Exploitation", "Privilege Escalation", "Denial of Service"], "mitre_attack": ["T1190"]} +annotations = {"kill_chain_phases": ["Exploitation", "Privilege Escalation", "Denial of Service"], "mitre_attack": ["T1190"]} known_false_positives = Unknown. Add new processes or filter as needed. It is possible system management software may spawn processes from `wsmprovhost.exe`. providing_technologies = [] @@ -7877,7 +8080,7 @@ asset_type = Endpoint confidence = medium explanation = This search looks for the execution of `adfind.exe` with command-line arguments that it uses by default. Specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST. AdFind.exe is usually used a recon tool to enumare a domain controller. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["NOBELIUM Group", "Domain Trust Discovery"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1018"], "nist": ["PR.PT", "DE.CM"]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1018"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = administrators rarely use adfind, usually not used for legitimate reasons providing_technologies = [] @@ -7887,7 +8090,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks for the Registry Key DisableAntiSpyware set to disable. This is consistent with Ryuk infections across a fleet of endpoints. This particular behavior is typically executed when an ransomware actor gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. -annotations = {"analytic_story": ["Ryuk Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. providing_technologies = [] @@ -7897,7 +8100,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic utilizes Windows Security Event ID 1102 or System log event 104 to identify when a Windows event log is cleared. Note that this analytic will require tuning or restricted to specific endpoints based on criticality. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. -annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]} known_false_positives = It is possible that these logs may be legitimately cleared by Administrators. Filter as needed. providing_technologies = [] @@ -7907,7 +8110,7 @@ asset_type = Endpoint confidence = medium explanation = The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. how_to_implement = You must be ingesting data that records the process-system activity from your hosts to populate the Endpoint Processes data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. -annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1489"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Target"], "type": "Process"}]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1489"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = SAM is a critical windows service, stopping it would cause major issues on an endpoint this makes false positive rare. AlthoughNo false positives have been identified. providing_technologies = [] @@ -7917,7 +8120,7 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk. how_to_implement = You must be ingesting data that records the process-system activity from your hosts to populate the Endpoint Processes data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. -annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} +annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} known_false_positives = This process should not be ran forcefully, we have not see any false positives for this detection providing_technologies = [] @@ -7927,17 +8130,27 @@ asset_type = Endpoint confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for modifications to the hosts file on all Windows endpoints across your environment. how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. -annotations = {"analytic_story": ["Host Redirection"], "cis20": ["CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"]} +annotations = {"cis20": ["CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"]} known_false_positives = There may be legitimate reasons for system administrators to add entries to this file. providing_technologies = [] +[savedsearch://ESCU - Winhlp32 Spawning a Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the ".hlp" file name extension. This particular instance is related to a Remcos sample where dynwrapx.dll is added to the registry under inprocserver32, and later module loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During triage, review parallel processes to identify further suspicious behavior. Review module loads for unsuspecting unsigned modules. Capture any file modifications and analyze. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +known_false_positives = False positives should be limited as winhlp32.exe is typically not used with the latest flavors of Windows OS. However, filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Winword Spawning Cmd - Rule] type = detection asset_type = confidence = medium explanation = The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). Cmd.exe spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line will indicate what is being executed. During triage, review parallel processes and identify any files that may have been written. It is possible that COM is utilized to trampoline the child process to `explorer.exe` or `wmiprvse.exe`. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = False positives should be limited, but if any are present, filter as needed. providing_technologies = [] @@ -7947,7 +8160,7 @@ asset_type = confidence = medium explanation = The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = False positives should be limited, but if any are present, filter as needed. providing_technologies = [] @@ -7957,7 +8170,7 @@ asset_type = confidence = medium explanation = The following detection identifies Microsoft Winword.exe spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64\`. `cscript.exe` or `wscript.exe` spawning from Winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line executed will most likely be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -annotations = {"analytic_story": ["Spearphishing Attachment"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} known_false_positives = There will be limited false positives and it will be different for every environment. Tune by child process or command-line as needed. providing_technologies = [] @@ -7969,7 +8182,7 @@ explanation = The following hunting analytic identifies the use of `wmic.exe` en Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} known_false_positives = Administrators or power users may use this command for troubleshooting. providing_technologies = [] @@ -7979,17 +8192,27 @@ asset_type = confidence = medium explanation = This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. This detection catch the access event (FILE WRITE) access to a share. how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. -annotations = {"analytic_story": ["Trickbot"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021", "T1021.002"]} known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Wscript Or Cscript Suspicious Child Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic is to detect a suspicious spawned process by wscript or cscript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other script like powershell or create a suspended process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1543", "T1134.004", "T1134"]} +known_false_positives = user may create vbs or js script that use several tool as part of its execution. +providing_technologies = [] + [savedsearch://ESCU - XMRIG Driver Loaded - Rule] type = detection asset_type = confidence = medium explanation = This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin. how_to_implement = To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "ImageLoaded"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003", "T1543"]} known_false_positives = False positives should be limited. providing_technologies = [] @@ -7999,7 +8222,7 @@ asset_type = confidence = medium explanation = This search is to detect a suspicious wmic.exe process or renamed wmic process to execute malicious xsl file. This technique was seen in FIN7 to execute its malicous jscript using the .xsl as the loader with the help of wmic.exe process. This TTP is really a good indicator for you to hunt further for FIN7 or other attacker that known to used this technique. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {"analytic_story": ["FIN7"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1220"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1220"]} known_false_positives = unknown providing_technologies = [] @@ -8009,7 +8232,7 @@ asset_type = AWS Account confidence = medium explanation = This search provides detection of an user attaching itself to a different role trust policy. This can be used for lateral movement and escalation of privileges. how_to_implement = You must install splunk AWS add-on and Splunk App for AWS. This search works with cloudwatch logs -annotations = {"analytic_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} known_false_positives = Attach to policy can create a lot of noise. This search can be adjusted to provide specific values to identify cases of abuse (i.e status=failure). The search can provide context for common users attaching themselves to higher privilege policies or even newly created policies. providing_technologies = [] @@ -8019,7 +8242,7 @@ asset_type = AWS Account confidence = medium explanation = This search provides detection of accounts creating permanent keys. Permanent keys are not created by default and they are only needed for programmatic calls. Creation of Permanent key is an important event to monitor. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs -annotations = {"analytic_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} known_false_positives = Not all permanent key creations are malicious. If there is a policy of rotating keys this search can be adjusted to provide better context. providing_technologies = [] @@ -8029,7 +8252,7 @@ asset_type = AWS Account confidence = medium explanation = This search provides detection of role creation by IAM users. Role creation is an event by itself if user is creating a new role with trust policies different than the available in AWS and it can be used for lateral movement and escalation of privileges. how_to_implement = You must install splunk AWS add-on and Splunk App for AWS. This search works with cloudwatch logs -annotations = {"analytic_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} known_false_positives = CreateRole is not very common in common users. This search can be adjusted to provide specific values to identify cases of abuse. In general AWS provides plenty of trust policies that fit most use cases. providing_technologies = [] @@ -8039,7 +8262,7 @@ asset_type = AWS Account confidence = medium explanation = This search provides detection of suspicious use of sts:AssumeRole. These tokens can be created on the go and used by attackers to move laterally and escalate privileges. how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs -annotations = {"analytic_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} known_false_positives = Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross account and cross resources access. This search can be adjusted to provide specific values to identify cases of abuse. providing_technologies = [] @@ -8049,7 +8272,7 @@ asset_type = AWS Account confidence = medium explanation = This search provides detection of suspicious use of sts:GetSessionToken. These tokens can be created on the go and used by attackers to move laterally and escalate privileges. how_to_implement = You must install splunk AWS add-on and Splunk App for AWS. This search works with cloudwatch logs -annotations = {"analytic_story": ["AWS Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1550"]} +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1550"]} known_false_positives = Sts:GetSessionToken can be very noisy as in certain environments numerous calls of this type can be executed. This search can be adjusted to provide specific values to identify cases of abuse. In specific environments the use of field requestParameters.serialNumber will need to be used. providing_technologies = [] @@ -8059,7 +8282,7 @@ asset_type = GCP Account confidence = medium explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access sessions alive without further control of authentication, allowing attackers to access and move laterally. how_to_implement = You must install splunk GCP add-on. This search works with gcp:pubsub:message logs -annotations = {"analytic_story": ["GCP Cross Account Activity"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} known_false_positives = GCP Oauth token abuse detection will only work if there are access policies in place along with audit logs. providing_technologies = [] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index d27ac95a7e..8b5b92e051 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-30T19:01:47 UTC +# On Date: 2021-10-26T01:24:23 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index d7431f404b..dbc6592a27 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -421,7 +421,7 @@ panels = ["panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_ransomware] label = Ransomware -description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Ransomware Investigate and Contain' +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Ransomware Investigate and Contain' disabled = 0 panels = ["panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_rundll32_lockworkstation___response_task"] diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index aeec603178..df7f7d68a9 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-30T19:01:48 UTC +# On Date: 2021-10-26T01:24:23 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -274,6 +274,10 @@ description = Matches the process with its original file name, data for this mac definition = (Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +[process_copy] +definition = (Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe) +description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ + [process_dllhost] definition = (Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ @@ -362,6 +366,14 @@ description = Matches the process with its original file name, data for this mac definition = (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +[process_sdelete] +definition = (Processes.process_name=sdelete.exe OR Processes.original_file_name=sdelete.exe) +description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ + +[process_verclsid] +definition = (Processes.process_name=verclsid.exe OR Processes.original_file_name=verclsid.exe) +description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ + [process_vssadmin] definition = (Processes.process_name=vssadmin.exe OR Processes.original_file_name=VSSADMIN.EXE) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ @@ -647,6 +659,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[active_setup_registry_autostart_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [add_defaultuser_and_password_in_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -831,6 +847,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[change_default_file_association_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [change_to_safe_mode_with_network_config_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1439,10 +1459,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[disable_security_logs_using_minint_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [disable_show_hidden_files_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. +[disable_uac_remote_restriction_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [disable_windows_app_hotkeys_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1571,6 +1599,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[etw_registry_disabled_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [elevated_group_discovery_with_net_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1599,6 +1631,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[enable_wdigest_uselogoncredential_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [enumerate_users_local_group_using_telegram_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2267,6 +2303,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[logon_script_event_trigger_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [ms_scripting_process_loading_ldap_module_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2275,6 +2315,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[msbuild_suspicious_spawned_by_script_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [mshtml_module_load_in_office_product_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2287,6 +2331,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[malicious_inprocserver32_modification_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [malicious_powershell_process___connect_to_internet_with_hidden_window_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2779,6 +2827,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[print_processor_registry_autostart_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [print_spooler_adding_a_printer_driver_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2803,6 +2855,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[process_writing_dynamicwrapperx_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [processes_tapping_keyboard_events_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2867,10 +2923,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[regsvr32_silent_param_dll_loading_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [remcos_rat_file_creation_in_remcos_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. +[remcos_client_registry_install_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [remote_desktop_network_bruteforce_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2955,6 +3019,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[rundll32_shimcache_flush_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [rundll32_with_no_command_line_arguments_with_network_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3031,6 +3099,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[screensaver_event_trigger_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [script_execution_via_wmi_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3039,6 +3111,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[sdelete_application_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [searchprotocolhost_with_no_command_line_with_network_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3127,6 +3203,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[suspicious_copy_on_system32_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [suspicious_curl_network_connection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3295,6 +3375,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[time_provider_persistence_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [trickbot_named_pipe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3363,6 +3447,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[vbscript_execution_using_wscript_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[verclsid_clsid_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [w3wp_spawning_shell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3467,6 +3559,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[winhlp32_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [winword_spawning_cmd_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3487,6 +3583,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[wscript_or_cscript_suspicious_child_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [xmrig_driver_loaded_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 7aa2f6c237..7eec41e2a2 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-30T19:01:47 UTC +# On Date: 2021-10-26T01:24:23 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -11,7 +11,7 @@ action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious 7z process with commandline pointing to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z to archive a sensitive files and place it in network share tmp folder. This search is a good hunting query that may give analyst a hint why specific user try to archive a file pointing to SMB user which is un usual. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious 7z process with commandline pointing to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z to archive a sensitive files and place it in network share tmp folder. This search is a good hunting query that may give analyst a hint why specific user try to archive a file pointing to SMB user which is un usual. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used. @@ -33,7 +33,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - 7zip CommandLine To SMB Share Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -228,7 +228,7 @@ search = `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI action.escu = 0 action.escu.enabled = 1 description = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -250,7 +250,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Create Policy Version to allow all resources - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 70, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 70, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -267,7 +267,7 @@ search = `cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws. action.escu = 0 action.escu.enabled = 1 description = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -289,7 +289,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS CreateAccessKey - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 90, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 90, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -306,7 +306,7 @@ search = `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws. action.escu = 0 action.escu.enabled = 1 description = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user B from the same src_ip as user B. This correlated event can be indicative of privilege escalation since both events happened from the same src_ip action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -328,7 +328,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS CreateLoginProfile - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -462,7 +462,7 @@ search = `cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-e action.escu = 0 action.escu.enabled = 1 description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -484,7 +484,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings High - Rule -action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "image", "role": ["Victim"], "type": "System"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "image", "role": ["Victim"], "type": "System"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. @@ -506,7 +506,7 @@ search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF action.escu = 0 action.escu.enabled = 1 description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -528,7 +528,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule -action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. @@ -550,7 +550,7 @@ search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF action.escu = 0 action.escu.enabled = 1 description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -572,7 +572,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Medium - Rule -action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "image", "role": ["Victim"], "type": "System"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "image", "role": ["Victim"], "type": "System"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. @@ -594,7 +594,7 @@ search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF action.escu = 0 action.escu.enabled = 1 description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it. action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -616,7 +616,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS ECR Container Upload Outside Business Hours - Rule -action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it. @@ -638,7 +638,7 @@ search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour action.escu = 0 action.escu.enabled = 1 description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event. action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -660,7 +660,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS ECR Container Upload Unknown User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event. @@ -917,7 +917,7 @@ search = `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorC action.escu = 0 action.escu.enabled = 1 description = The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner. -action.escu.mappings = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1069.003", "T1098"]} +action.escu.mappings = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1069.003", "T1098", "T1069"]} action.escu.data_models = [] action.escu.eli5 = The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner. action.escu.how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. @@ -939,7 +939,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS IAM Successful Group Deletion - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution"], "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1069.003", "T1098"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}, {"name": "group_deleted", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution"], "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1069.003", "T1098", "T1069"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}, {"name": "group_deleted", "role": ["Victim"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -956,7 +956,7 @@ search = `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorC action.escu = 0 action.escu.enabled = 1 description = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. -action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs. @@ -978,7 +978,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Network Access Control List Created with All Open Ports - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "userName", "role": ["Victim"], "type": "User"}, {"name": "requestParameters.cidrBlock", "role": ["Victim"], "type": "IP Address"}]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "userName", "role": ["Victim"], "type": "User"}, {"name": "requestParameters.cidrBlock", "role": ["Victim"], "type": "IP Address"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -995,7 +995,7 @@ search = `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor action.escu = 0 action.escu.enabled = 1 description = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. -action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. @@ -1017,7 +1017,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS Network Access Control List Deleted - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution"], "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"], "cis20": ["CIS 11"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:External", "Stage:Execution"], "impact": 10, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1112,7 +1112,7 @@ search = `cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as f action.escu = 0 action.escu.enabled = 1 description = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation in case the previous versions of the policy had permissions to access more resources than the current version of the policy action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -1134,7 +1134,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS SetDefaultPolicyVersion - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Credential Access", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Credential Access", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1151,7 +1151,7 @@ search = `cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazon action.escu = 0 action.escu.enabled = 1 description = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. @@ -1173,7 +1173,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AWS UpdateLoginProfile - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 60, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["AWS IAM Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 60, "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_arn", "role": ["Victim"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1360,7 +1360,7 @@ search = `cloudtrail` eventName=TerminateInstances errorCode=success `abnormally action.escu = 0 action.escu.enabled = 1 description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user. -action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} action.escu.data_models = ["Change"] action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user. action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function. @@ -1382,7 +1382,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1399,7 +1399,7 @@ search = | tstats count as api_calls values(All_Changes.command) as command from action.escu = 0 action.escu.enabled = 1 description = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = ["Change"] action.escu.eli5 = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function. @@ -1421,7 +1421,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1438,7 +1438,7 @@ search = | tstats count as instances_destroyed values(All_Changes.object_id) as action.escu = 0 action.escu.enabled = 1 description = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = ["Change"] action.escu.eli5 = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers. action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function. @@ -1460,7 +1460,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1477,7 +1477,7 @@ search = | tstats count as instances_launched values(All_Changes.object_id) as o action.escu = 0 action.escu.enabled = 1 description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user. -action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} +action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} action.escu.data_models = ["Change"] action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user. action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model. @@ -1499,7 +1499,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:Inbound", "Outcome:Allowed", "Stage:Execution", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:Inbound", "Outcome:Allowed", "Stage:Execution", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1516,7 +1516,7 @@ search = | tstats count as security_group_api_calls values(All_Changes.command) action.escu = 0 action.escu.enabled = 1 description = Detect memory dumping of the LSASS process. -action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]} action.escu.data_models = [] action.escu.eli5 = Detect memory dumping of the LSASS process. action.escu.how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. @@ -1538,7 +1538,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Access LSASS Memory for Dump Creation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "TargetImage", "role": ["Target"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "TargetImage", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -1561,7 +1561,7 @@ search = `sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR action.escu = 0 action.escu.enabled = 1 description = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.. @@ -1583,7 +1583,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Account Discovery With Net App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "IcedID"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 10, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Process"], "type": "Process Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "IcedID"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 10, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Process"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1602,11 +1602,56 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter` +[ESCU - Active Setup Registry Autostart - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.014", "T1547"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = Active setup installer may add or modify this registry. +action.escu.creation_date = 2021-09-28 +action.escu.modification_date = 2021-09-28 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Active Setup Registry Autostart - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation"] +action.risk = 1 +action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Active Setup Registry Autostart - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation"], "confidence": 80, "context": ["source:endpoint", "stage:Privilege Escalation Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.014", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. +action.notable.param.rule_title = Active Setup Registry Autostart +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter` + [ESCU - Add DefaultUser And Password In Registry - Rule] action.escu = 0 action.escu.enabled = 1 description = this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002", "T1552"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -1628,7 +1673,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Add DefaultUser And Password In Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["BlackMatter Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["BlackMatter Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002", "T1552"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -1651,7 +1696,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -1673,7 +1718,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - AdsiSearcher Account Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. @@ -1695,7 +1740,7 @@ search = `powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*ob action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious modification of firewall to allow file and printer sharing. This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious modification of firewall to allow file and printer sharing. This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -1713,7 +1758,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Allow File And Printing Sharing In Firewall - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1736,7 +1781,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -1758,7 +1803,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1781,7 +1826,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -1803,7 +1848,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Allow Inbound Traffic In Firewall Rule - Rule -action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. @@ -1825,7 +1870,7 @@ search = `powershell` EventCode=4104 Message = "*firewall*" Message = "*Inbound* action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host to encrypt more files. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host to encrypt more files. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -1843,7 +1888,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Allow Network Discovery In Firewall - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1991,7 +2036,7 @@ search = `aws_cloudwatchlogs_eks` "user.username"="system:anonymous" userAgent!= action.escu = 0 action.escu.enabled = 1 description = The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`. It has been observed where an adversary will rename `7z.exe`. Additional coverage may be required to identify the behavior of renamed instances of `7z.exe`. During triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture any files written to disk and analyze as needed. Review parallel processes for additional behaviors. Typically, archiving files will result in exfiltration. -action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1560.001"]} +action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1560.001", "T1560"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`. It has been observed where an adversary will rename `7z.exe`. Additional coverage may be required to identify the behavior of renamed instances of `7z.exe`. During triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture any files written to disk and analyze as needed. Review parallel processes for additional behaviors. Typically, archiving files will result in exfiltration. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -2013,7 +2058,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Anomalous usage of 7zip - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike", "NOBELIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike", "NOBELIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1560.001", "T1560"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2036,7 +2081,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -2058,7 +2103,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Any Powershell DownloadFile - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Ingress Tool Transfer"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Exploitation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Ingress Tool Transfer"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Exploitation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2081,7 +2126,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies the use of PowerShell downloading a file using `DownloadString` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies the use of PowerShell downloading a file using `DownloadString` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -2103,7 +2148,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Any Powershell DownloadString - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "HAFNIUM Group", "Ingress Tool Transfer"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "HAFNIUM Group", "Ingress Tool Transfer"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2126,7 +2171,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for execution of commonly used attacker tools on an endpoint. -action.escu.mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1595", "T1003"], "nist": ["ID.AM", "PR.DS"]} +action.escu.mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1036", "T1003", "T1595"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for execution of commonly used attacker tools on an endpoint. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. @@ -2148,7 +2193,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attacker Tools On Endpoint - Rule -action.correlationsearch.annotations = {"analytic_story": ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"], "cis20": ["CIS 2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exploitation", "Stage:Recon", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1595", "T1003"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process", "Attacker"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"], "cis20": ["CIS 2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exploitation", "Stage:Recon", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1036", "T1003", "T1595"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process", "Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2171,7 +2216,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = Attempt To Add Certificate To Untrusted Store -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004", "T1553"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Attempt To Add Certificate To Untrusted Store action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -2193,7 +2238,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempt To Add Certificate To Untrusted Store - Rule -action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004", "T1553"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2216,7 +2261,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for attempts to stop security-related services on the endpoint. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for attempts to stop security-related services on the endpoint. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -2238,7 +2283,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempt To Stop Security Service - Rule -action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools", "Trickbot"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools", "Trickbot"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2261,7 +2306,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -2283,7 +2328,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry via Reg exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2306,7 +2351,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002", "T1552"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -2328,7 +2373,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Auto Admin Logon Registry Entry - Rule -action.correlationsearch.annotations = {"analytic_story": ["BlackMatter Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["BlackMatter Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002", "T1552"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -2486,7 +2531,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The search looks for a batch file (.bat) written to the Windows system directory tree. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204.002"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204", "T1204.002"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The search looks for a batch file (.bat) written to the Windows system directory tree. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -2508,7 +2553,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Batch File Write to System32 - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204", "T1204.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -2621,7 +2666,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. -action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059", "T1059.003", "T1543.003", "T1543"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -2643,7 +2688,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CMD Echo Pipe - Escalation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059", "T1059.003", "T1543.003", "T1543"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2666,7 +2711,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"]} action.escu.data_models = [] action.escu.eli5 = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -2688,7 +2733,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. @@ -2886,6 +2931,51 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `certutil_exe_certificate_extraction_filter` +[ESCU - Change Default File Association - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other payload that will load malicious command to the compromised host. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.001", "T1546"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other payload that will load malicious command to the compromised host. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-09-27 +action.escu.modification_date = 2021-09-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Change Default File Association - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation"] +action.risk = 1 +action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Change Default File Association - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation"], "confidence": 100, "context": ["source:endpoint", "stage:Privilege Escalation Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.001", "T1546"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other payload that will load malicious command to the compromised host. +action.notable.param.rule_title = Change Default File Association +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `change_default_file_association_filter` + [ESCU - Change To Safe Mode With Network Config - Rule] action.escu = 0 action.escu.enabled = 1 @@ -2998,7 +3088,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Child Processes of Spoolsv exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 5", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["PR.AC", "PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 5", "CIS 8"], "cve": ["CVE-2018-8440"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["PR.AC", "PR.PT", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3111,7 +3201,7 @@ search = `circleci` | rename workflows.job_id AS job_id | join job_id [ | search action.escu = 0 action.escu.enabled = 1 description = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004", "T1070"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -3133,7 +3223,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Clear Unallocated Sector Using Cipher App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Impact"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Impact"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004", "T1070"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3327,7 +3417,7 @@ search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from d action.escu = 0 action.escu.enabled = 1 description = This search looks for cloud compute instances created by users who have not created them before. -action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} +action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"]} action.escu.data_models = ["Change"] action.escu.eli5 = This search looks for cloud compute instances created by users who have not created them before. action.escu.how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users. @@ -3349,7 +3439,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1078.004"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -3483,7 +3573,7 @@ search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime values action.escu = 0 action.escu.enabled = 1 description = This search looks for cloud instances being modified by users who have not previously modified them. -action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} +action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"]} action.escu.data_models = ["Change"] action.escu.eli5 = This search looks for cloud instances being modified by users who have not previously modified them. action.escu.how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search "Previously Seen Cloud Instance Modifications By User - Update" should be enabled for this detection to properly work. @@ -3505,7 +3595,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cloud Instance Modified By Previously Unseen User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078.004"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -3723,7 +3813,7 @@ search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from d action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious parent process execution of commandline tool not in shell commandline. This technique was seen in FIN7 JSSLoader .net compile payload where it run ipconfig.exe and systeminfo.exe using .net application. This event cause some good TTP since those tool are commonly run in commandline not by another application. This TTP is a good indicator for application gather host information either an attacker or an automated tool made by admin. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious parent process execution of commandline tool not in shell commandline. This technique was seen in FIN7 JSSLoader .net compile payload where it run ipconfig.exe and systeminfo.exe using .net application. This event cause some good TTP since those tool are commonly run in commandline not by another application. This TTP is a good indicator for application gather host information either an attacker or an automated tool made by admin. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -3745,7 +3835,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cmdline Tool Not Executed In CMD Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3955,7 +4045,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following detection identifies control.exe loading either a .cpl or .inf from a writable directory. This is related to CVE-2021-40444. During triage, review parallel processes, parent and child, for further suspicious behaviors. In addition, capture file modifications and analyze. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.002"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies control.exe loading either a .cpl or .inf from a writable directory. This is related to CVE-2021-40444. During triage, review parallel processes, parent and child, for further suspicious behaviors. In addition, capture file modifications and analyze. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -3977,7 +4067,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Control Loading from World Writable Directory - Rule -action.correlationsearch.annotations = {"analytic_story": ["Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4000,7 +4090,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search correlations detections by repository and risk_score -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search correlations detections by repository and risk_score action.escu.how_to_implement = For Dev Sec Ops POC @@ -4022,7 +4112,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Correlation by Repository and Risk - Rule -action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -4045,7 +4135,7 @@ search = `signals` | fillnull | stats sum(risk_score) as risk_score values(sourc action.escu = 0 action.escu.enabled = 1 description = This search correlations detections by user and risk_score -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search correlations detections by user and risk_score action.escu.how_to_implement = For Dev Sec Ops POC @@ -4067,7 +4157,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Correlation by User and Risk - Rule -action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -4134,7 +4224,7 @@ search = `sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") | action.escu = 0 action.escu.enabled = 1 description = Detect remote thread creation into LSASS consistent with credential dumping. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]} action.escu.data_models = [] action.escu.eli5 = Detect remote thread creation into LSASS consistent with credential dumping. action.escu.how_to_implement = This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. @@ -4156,7 +4246,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create Remote Thread into LSASS - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "TargetImage", "role": ["Other"], "type": "Other"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "TargetImage", "role": ["Other"], "type": "Other"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -4179,7 +4269,7 @@ search = `sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as f action.escu = 0 action.escu.enabled = 1 description = This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. -action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"]} +action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569", "T1569.002"]} action.escu.data_models = [] action.escu.eli5 = This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. @@ -4201,7 +4291,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create Service In Suspicious File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"], "observable": [{"name": "Service_File_Name", "role": ["Other"], "type": "Other"}, {"name": "Service_Name", "role": ["Other"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569", "T1569.002"], "observable": [{"name": "Service_File_Name", "role": ["Other"], "type": "Other"}, {"name": "Service_Name", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -4224,7 +4314,7 @@ search = `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT action.escu = 0 action.escu.enabled = 1 description = This search looks for the creation of local administrator accounts using net.exe . -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for the creation of local administrator accounts using net.exe . action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -4246,7 +4336,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create local admin accounts using net exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4269,7 +4359,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.user) action.escu = 0 action.escu.enabled = 1 description = This search looks for the creation or deletion of hidden shares using net.exe. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.005"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.005"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for the creation or deletion of hidden shares using net.exe. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -4291,7 +4381,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create or delete windows shares using net exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4314,7 +4404,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.user) action.escu = 0 action.escu.enabled = 1 description = Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -4336,7 +4426,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4359,7 +4449,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search detects the use of wmic and Powershell to create a shadow copy. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search detects the use of wmic and Powershell to create a shadow copy. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -4381,7 +4471,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of Shadow Copy with wmic and powershell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4404,7 +4494,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. -action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]} action.escu.data_models = [] action.escu.eli5 = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. action.escu.how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. @@ -4426,7 +4516,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of lsass Dump with Taskmgr - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetFilename", "role": ["Victim"], "type": "File Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetFilename", "role": ["Victim"], "type": "File Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -4449,7 +4539,7 @@ search = `sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp action.escu = 0 action.escu.enabled = 1 description = This search detects credential dumping using copy command from a shadow copy. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search detects credential dumping using copy command from a shadow copy. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -4471,7 +4561,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4494,7 +4584,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search detects the creation of a symlink to a shadow copy. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search detects the creation of a symlink to a shadow copy. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -4516,7 +4606,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Credential Dumping via Symlink to Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4544,8 +4634,8 @@ action.escu.data_models = [] action.escu.eli5 = The following analytic identifies DLLHost.exe with no command line arguments with a network connection. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. action.escu.known_false_positives = Although unlikely, some legitimate third party applications may use a moved copy of dllhost, triggering a false positive. -action.escu.creation_date = 2021-04-19 -action.escu.modification_date = 2021-04-19 +action.escu.creation_date = 2021-10-13 +action.escu.modification_date = 2021-10-13 action.escu.confidence = high action.escu.full_search_name = ESCU - DLLHost with no Command Line Arguments with Network - Rule action.escu.search_type = detection @@ -4578,7 +4668,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(dllhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(dllhost\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter` [ESCU - DNS Exfiltration Using Nslookup App - Rule] action.escu = 0 @@ -4629,7 +4719,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = This search allows you to identify DNS requests that are unusually large for the record type being requested in your environment. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} action.escu.data_models = ["Network_Resolution"] action.escu.eli5 = This search allows you to identify DNS requests that are unusually large for the record type being requested in your environment. action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of DNS Query Length - MLTK" must be executed before this detection search, because it builds a machine-learning (ML) model over the historical data used by this search. It is important that this search is run in the same app context as the associated support search, so that the model created by the support search is available for use. You should periodically re-run the support search to rebuild the model with the latest data available in your environment.\ @@ -4653,7 +4743,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DNS Query Length Outliers - MLTK - Rule -action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -4676,13 +4766,13 @@ search = | tstats `security_content_summariesonly` count min(_time) as start_tim action.escu = 0 action.escu.enabled = 1 description = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} action.escu.data_models = ["Network_Resolution"] action.escu.eli5 = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. action.escu.known_false_positives = It's possible there can be long domain names that are legitimate. -action.escu.creation_date = 2021-07-21 -action.escu.modification_date = 2021-07-21 +action.escu.creation_date = 2021-10-06 +action.escu.modification_date = 2021-10-06 action.escu.confidence = high action.escu.full_search_name = ESCU - DNS Query Length With High Standard Deviation - Rule action.escu.search_type = detection @@ -4698,7 +4788,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DNS Query Length With High Standard Deviation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}, {"name": "query", "role": ["Attacker"], "type": "dnsquery"}]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}, {"name": "query", "role": ["Attacker"], "type": "dnsquery"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. @@ -4714,7 +4804,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")` | eval query_length = len(query) | table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter` +search = | tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")` | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) | search tld_len<=24 | eval query_length = len(query) | table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter` [ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule] action.escu = 0 @@ -5051,7 +5141,7 @@ search = `cloudtrail` userIdentity.sessionContext.attributes.mfaAuthenticated=fa action.escu = 0 action.escu.enabled = 1 description = By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure. -action.escu.mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +action.escu.mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = [] action.escu.eli5 = By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure. action.escu.how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and Dynamic ARP Inspection (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/security/configuration_guide/b_sec_1522e_2960x_cg/b_sec_1522e_2960x_cg_chapter_01111.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices. @@ -5069,7 +5159,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect ARP Poisoning - Rule -action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['src_interface', 'firstTime', 'lastTime', 'count'] @@ -5299,7 +5389,7 @@ search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from da action.escu = 0 action.escu.enabled = 1 description = This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550", "T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} action.escu.data_models = [] action.escu.eli5 = This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. action.escu.how_to_implement = To successfully implement this search, you must ingest your Windows Security Event logs and leverage the latest TA for Windows. @@ -5321,7 +5411,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Activity Related to Pass the Hash Attacks - Rule -action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550", "T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -5344,7 +5434,7 @@ search = `wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmS action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -5366,7 +5456,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AzureHound Command-Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5389,7 +5479,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment as most attackers may execute this tool remotely. Once execution is complete, a zip file with a similar name will drop `20210601090751-azurecollection.zip`. In addition to the zip, multiple .json files will be written to disk, which are in the zip. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -5411,7 +5501,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AzureHound File Modifications - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -5452,7 +5542,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 - Rule -action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "cve": ["CVE-2021-3156"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects the heap-based buffer overflow of sudoedit @@ -5492,7 +5582,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule -action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "cve": ["CVE-2021-3156"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects the heap-based buffer overflow of sudoedit @@ -5532,7 +5622,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "cve": ["CVE-2021-3156"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects the heap-based buffer overflow of sudoedit @@ -5576,7 +5666,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Computer Changed with Anonymous Account - Rule -action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 6", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 6", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "cve": ["CVE-2020-1472"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -5601,7 +5691,7 @@ action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ @@ -5625,7 +5715,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-36934"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ @@ -5649,7 +5739,7 @@ search = `powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Co action.escu = 0 action.escu.enabled = 1 description = This search looks for reading lsass memory consistent with credential dumping. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for reading lsass memory consistent with credential dumping. action.escu.how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. @@ -5671,7 +5761,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Credential Dumping through LSASS access - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"], "observable": [{"name": "source_image", "role": ["Victim"], "type": "Other"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetImage", "role": ["Victim"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["PR.IP", "PR.AC", "DE.CM"], "observable": [{"name": "source_image", "role": ["Victim"], "type": "Other"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetImage", "role": ["Victim"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -5741,7 +5831,7 @@ action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ @@ -5765,7 +5855,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Empire with PowerShell Script Block Logging - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ @@ -5789,7 +5879,7 @@ search = `powershell` EventCode=4104 (Message=*system.net.webclient* AND Messag action.escu = 0 action.escu.enabled = 1 description = This search identifies endpoints that have caused a relatively high number of account lockouts in a short period. -action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.002"], "nist": ["PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["PR.IP"]} action.escu.data_models = ["Change"] action.escu.eli5 = This search identifies endpoints that have caused a relatively high number of account lockouts in a short period. action.escu.how_to_implement = You must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. \ @@ -5815,7 +5905,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Excessive Account Lockouts From Endpoint - Rule -action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078.002"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078", "T1078.002"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5838,7 +5928,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search detects user accounts that have been locked out a relatively high number of times in a short period. -action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.003"], "nist": ["PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.003"], "nist": ["PR.IP"]} action.escu.data_models = ["Change"] action.escu.eli5 = This search detects user accounts that have been locked out a relatively high number of times in a short period. action.escu.how_to_implement = ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. @@ -5860,7 +5950,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Excessive User Account Lockouts - Rule -action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078.003"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "result", "role": ["Victim"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078", "T1078.003"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "result", "role": ["Victim"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -5882,14 +5972,14 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Detect Exchange Web Shell - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"]} +description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"]} action.escu.data_models = [] -action.escu.eli5 = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. +action.escu.eli5 = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. action.escu.known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. -action.escu.creation_date = 2021-03-09 -action.escu.modification_date = 2021-03-09 +action.escu.creation_date = 2021-10-05 +action.escu.modification_date = 2021-10-05 action.escu.confidence = high action.escu.full_search_name = ESCU - Detect Exchange Web Shell - Rule action.escu.search_type = detection @@ -5905,11 +5995,11 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Exchange Web Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exploitation"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exploitation"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. +action.notable.param.rule_description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant. action.notable.param.rule_title = Detect Exchange Web Shell action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -5946,7 +6036,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule -action.correlationsearch.annotations = {"analytic_story": ["F5 TMUI RCE CVE-2020-5902"], "cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["F5 TMUI RCE CVE-2020-5902"], "cis20": ["CIS 8", "CIS 11"], "cve": ["CVE-2020-5902"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traffix SDC devices @@ -6008,7 +6098,7 @@ search = `google_gcp_pubsub_message` | multikv | rename sc_status_ as status | r action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -6030,7 +6120,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help Renamed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6053,7 +6143,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review child process events and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review child process events and investigate further. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -6075,7 +6165,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help Spawn Child Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6098,7 +6188,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -6120,7 +6210,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help URL in Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6143,7 +6233,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm file from within a CHM file. CHM files may contain nearly any file type embedded. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm file from within a CHM file. CHM files may contain nearly any file type embedded. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -6165,7 +6255,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6188,7 +6278,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's network devices, we will be able to detect various attacks such as packet forging in the Infrastructure. -action.escu.mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +action.escu.mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = [] action.escu.eli5 = By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's network devices, we will be able to detect various attacks such as packet forging in the Infrastructure. action.escu.how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with one or more First Hop Security measures such as RA Guard, DHCP Guard and/or device tracking. See References for more information. The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices. @@ -6206,7 +6296,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect IPv6 Network Infrastructure Threats - Rule -action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's network devices, we will be able to detect various attacks such as packet forging in the Infrastructure. @@ -6309,7 +6399,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic identifies when Microsoft HTML Application Host (mshta.exe) utility is used to make remote http connections. Adversaries may use mshta.exe to proxy the download and execution of remote .hta files. The analytic identifies command line arguments of http and https being used. This technique is commonly used by malicious software to bypass preventative controls. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic identifies when Microsoft HTML Application Host (mshta.exe) utility is used to make remote http connections. Adversaries may use mshta.exe to proxy the download and execution of remote .hta files. The analytic identifies command line arguments of http and https being used. This technique is commonly used by malicious software to bypass preventative controls. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -6331,7 +6421,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect MSHTA Url in Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6354,7 +6444,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. -action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. action.escu.how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. @@ -6376,7 +6466,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Mimikatz Using Loaded Images - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Parent Process"}, {"name": "Image", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Parent Process"}, {"name": "Image", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6489,7 +6579,7 @@ search = `powershell` EventCode=4104 Message IN (*mimikatz*, *-dumpcr*, *sekurls action.escu = 0 action.escu.enabled = 1 description = This search looks for newly created accounts that have been elevated to local administrators. -action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for newly created accounts that have been elevated to local administrators. action.escu.how_to_implement = You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 @@ -6511,7 +6601,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect New Local Admin account - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6694,7 +6784,7 @@ search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex action.escu = 0 action.escu.enabled = 1 description = This search looks for outbound SMB connections made by hosts within your network to the Internet. SMB traffic is used for Windows file-sharing activity. One of the techniques often used by attackers involves retrieving the credential hash using an SMB request made to a compromised server controlled by the threat actor. -action.escu.mappings = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.002"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.002", "T1071"], "nist": ["DE.CM"]} action.escu.data_models = ["Network_Traffic"] action.escu.eli5 = This search looks for outbound SMB connections made by hosts within your network to the Internet. SMB traffic is used for Windows file-sharing activity. One of the techniques often used by attackers involves retrieving the credential hash using an SMB request made to a compromised server controlled by the threat actor. action.escu.how_to_implement = In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have good understanding of how your network segments are designed, and be able to distinguish internal from external address space. Add a category named `internal` to the CIDRs that host the companys assets in `assets_by_cidr.csv` lookup file, which is located in `$SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/`. More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. This search also requires you to be ingesting your network traffic and populating the Network_Traffic data model @@ -6712,7 +6802,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Outbound SMB Traffic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.002"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.002", "T1071"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for outbound SMB connections made by hosts within your network to the Internet. SMB traffic is used for Windows file-sharing activity. One of the techniques often used by attackers involves retrieving the credential hash using an SMB request made to a compromised server controlled by the threat actor. @@ -6734,7 +6824,7 @@ search = | tstats `security_content_summariesonly` earliest(_time) as start_time action.escu = 0 action.escu.enabled = 1 description = This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk. -action.escu.mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.001"], "nist": ["ID.AM", "PR.DS"]} +action.escu.mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = [] action.escu.eli5 = This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk. action.escu.how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. @@ -6752,7 +6842,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Outlook exe writing a zip file - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.001"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6775,7 +6865,7 @@ search = | tstats `security_content_summariesonly` min(_time) as firstTime max( action.escu = 0 action.escu.enabled = 1 description = The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009", "T1574"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -6797,7 +6887,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Path Interception By Creation Of program exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009", "T1574"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6820,7 +6910,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs. -action.escu.mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Exploitation", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +action.escu.mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Exploitation", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = [] action.escu.eli5 = By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs. action.escu.how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with Port Security and Error Disable for this to work (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices. @@ -6838,7 +6928,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Port Security Violation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Exploitation", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Exploitation", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs. @@ -6860,7 +6950,7 @@ search = `cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="p action.escu = 0 action.escu.enabled = 1 description = This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts and populates the Endpoint data model with the resultant dataset. This search includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list of processes that should not be spawning cmd.exe. You can modify this lookup to better suit your environment. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -6882,7 +6972,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Prohibited Applications Spawning cmd exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6905,7 +6995,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument `accepteula` within the command line. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021", "T1021.002"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument `accepteula` within the command line. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -6927,7 +7017,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect PsExec With accepteula Flag - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021", "T1021.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7036,7 +7126,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.dest) action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -7058,7 +7148,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regasm Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7081,7 +7171,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -7103,7 +7193,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regasm with Network Connection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -7126,7 +7216,7 @@ search = `sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip! action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -7148,7 +7238,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regasm with no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -7171,7 +7261,7 @@ search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process is rare from either process and should be investigated further. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -7193,7 +7283,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7216,7 +7306,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -7238,7 +7328,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs with Network Connection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -7261,7 +7351,7 @@ search = `sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip! action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -7283,7 +7373,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs with No Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -7307,7 +7397,7 @@ action.escu = 0 action.escu.enabled = 1 description = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is often referred to as a "Squiblydoo" attack. \ Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is often referred to as a "Squiblydoo" attack. \ Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. @@ -7330,7 +7420,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvr32 Application Control Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Cobalt Strike"], "cis20": ["CIS 8", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Cobalt Strike"], "cis20": ["CIS 8", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7354,7 +7444,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. During triage, validate this is the legitimate version of `7zip` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior. -action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001", "T1560"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the OriginalFileName to capture the renamed process. During triage, validate this is the legitimate version of `7zip` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -7376,7 +7466,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Renamed 7-Zip - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001", "T1560"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7399,7 +7489,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. During triage, validate this is the legitimate version of `PsExec` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior. -action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569", "T1569.002"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. During triage, validate this is the legitimate version of `PsExec` by reviewing the PE metadata. In addition, review parallel processes for further suspicious behavior. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -7421,7 +7511,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Renamed PSExec - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569", "T1569.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7489,7 +7579,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. -action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001", "T1560"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. During triage, validate additional metadata from the binary that this is `WinRAR`. Review parallel processes and file modifications. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -7511,7 +7601,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Renamed WinRAR - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001", "T1560"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7575,7 +7665,7 @@ search = `cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRU action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -7597,7 +7687,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7620,7 +7710,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -7642,7 +7732,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7665,7 +7755,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module loads may occur - clr.dll, jscript.dll and scrobj.dll. During investigation, identify script content origination. Generally, a child process will spawn from rundll32.exe, but that may be bypassed based on script code contents. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review any network connections and obtain the script content executed. It's possible other files are on disk. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -7687,7 +7777,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7710,7 +7800,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies "rundll32.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. This type of behavior is commonly observed with fileless malware or application whitelisting bypass techniques. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies "rundll32.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. This type of behavior is commonly observed with fileless malware or application whitelisting bypass techniques. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -7732,7 +7822,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Inline HTA Execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7839,7 +7929,7 @@ search = `zeek_ssl` | rex field=server_name "(?(LIST|LS|SIZE|LD|CB|CD|EX action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -7861,7 +7951,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect SharpHound Command-Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7884,7 +7974,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -7906,7 +7996,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect SharpHound File Modifications - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -7929,7 +8019,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies SharpHound binary usage by using the original filena,e. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic looks for the original_file_name of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies SharpHound binary usage by using the original filena,e. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic looks for the original_file_name of `SharpHound.exe` and the process name. It is possible older instances of SharpHound.exe have different original filenames. Dependent upon the operator, the code may be re-compiled and the attributes removed or changed to anything else. During triage, review the metadata of the binary in question. Review parallel processes for suspicious behavior. Identify the source of this binary. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -7951,7 +8041,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect SharpHound Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7974,7 +8064,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. -action.escu.mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1542.005"], "nist": ["ID.AM", "PR.DS"]} +action.escu.mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1542.005", "T1542"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = ["Network_Traffic"] action.escu.eli5 = Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. action.escu.how_to_implement = This search looks for Network Traffic events to TFTP, FTP or SSH/SCP ports from network devices. Make sure to tag any network devices as network, router or switch in order for this detection to work. If the TFTP traffic doesn't traverse a firewall nor packet inspection, these events will not be logged. This is typically an issue if the TFTP server is on the same subnet as the network device. There is also a chance of the network device loading software using a DHCP assigned IP address (netboot) which is not in the Asset inventory. @@ -7992,7 +8082,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Software Download To Network Device - Rule -action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1542.005"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1542.005", "T1542"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -8325,7 +8415,7 @@ search = `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=17 action.escu = 0 action.escu.enabled = 1 description = Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. -action.escu.mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1020.001"], "nist": ["ID.AM", "PR.DS"]} +action.escu.mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1020", "T1498", "T1020.001"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = [] action.escu.eli5 = Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. action.escu.how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices and that the devices have been configured according to the documentation of the Cisco Networks Add-on. Also note that an attacker may disable logging from the device prior to enabling traffic mirroring. @@ -8343,7 +8433,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Traffic Mirroring - Rule -action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1020.001"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1020", "T1498", "T1020.001"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. @@ -8446,7 +8536,7 @@ search = | tstats `security_content_summariesonly` count from datamodel=Network_ action.escu = 0 action.escu.enabled = 1 description = This search looks for the execution of the cscript.exe or wscript.exe processes, with a parent of cmd.exe. The search will return the count, the first and last time this execution was seen on a machine, the user, and the destination of the machine -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for the execution of the cscript.exe or wscript.exe processes, with a parent of cmd.exe. The search will return the count, the first and last time this execution was seen on a machine, the user, and the destination of the machine action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -8468,7 +8558,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule -action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8496,7 +8586,7 @@ All event subscriptions have three components \ 1. Consumer - An action to take upon triggering the filter. EventID equals 20 \ 1. Binding - Registers a filter to a consumer. EventID equals 21 \ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003", "T1546"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ All event subscriptions have three components \ @@ -8523,7 +8613,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect WMI Event Subscription Persistence - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003", "T1546"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ @@ -8568,7 +8658,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 12"], "cve": ["CVE-2020-1350"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects SIGRed via Splunk Stream. @@ -8608,7 +8698,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Windows DNS SIGRed via Zeek - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 16"], "cve": ["CVE-2020-1350"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects SIGRed via Zeek DNS and Zeek Conn data. @@ -8648,7 +8738,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Zerologon via Zeek - Rule -action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 8", "CIS 11"], "cve": ["CVE-2020-1472"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC @@ -8802,7 +8892,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies "mshta.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies "mshta.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -8824,7 +8914,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect mshta inline hta execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8847,7 +8937,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This analytic utilizes the internal name of the PE to identify if is the legitimate mshta binary. Further analysis should be performed to review the executed content and validation it is the real mshta. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This analytic utilizes the internal name of the PE to identify if is the legitimate mshta binary. Further analysis should be performed to review the executed content and validation it is the real mshta. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -8869,7 +8959,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect mshta renamed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9187,7 +9277,7 @@ search = | tstats `security_content_summariesonly` count min(_time) values(Proce action.escu = 0 action.escu.enabled = 1 description = this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9205,7 +9295,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable AMSI Through Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9228,7 +9318,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9246,7 +9336,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable ETW Through Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9269,7 +9359,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070", "T1070.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -9291,7 +9381,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Logs Using WevtUtil - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070", "T1070.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9314,7 +9404,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9336,7 +9426,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Registry Tool - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9355,11 +9445,56 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_registry_tool_filter` +[ESCU - Disable Security Logs Using MiniNt Registry - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = Unknown. +action.escu.creation_date = 2021-10-05 +action.escu.modification_date = 2021-10-05 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Disable Security Logs Using MiniNt Registry - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Disable Security Logs Using MiniNt Registry - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log +action.notable.param.rule_title = Disable Security Logs Using MiniNt Registry +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_security_logs_using_minint_registry_filter` + [ESCU - Disable Show Hidden Files - Rule] action.escu = 0 action.escu.enabled = 1 description = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001", "T1564", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9381,7 +9516,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Show Hidden Files - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001", "T1564", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9400,11 +9535,56 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter` +[ESCU - Disable UAC Remote Restriction - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = admin may set this policy for non-critical machine. +action.escu.creation_date = 2021-09-29 +action.escu.modification_date = 2021-09-29 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Disable UAC Remote Restriction - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"] +action.risk = 1 +action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Disable UAC Remote Restriction - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"], "confidence": 100, "context": ["source:endpoint", "stage:Privilege Escalation Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. +action.notable.param.rule_title = Disable UAC Remote Restriction +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_uac_remote_restriction_filter` + [ESCU - Disable Windows App Hotkeys - Rule] action.escu = 0 action.escu.enabled = 1 description = This analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. This technique is used to impair the analyst in analyzing and removing the attacker implant in compromised systems. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = [] action.escu.eli5 = This analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. This technique is used to impair the analyst in analyzing and removing the attacker implant in compromised systems. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. @@ -9426,7 +9606,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Windows App Hotkeys - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9449,7 +9629,7 @@ search = | tstats `security_content_summariesonly` count values(Registry.registr action.escu = 0 action.escu.enabled = 1 description = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9471,7 +9651,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Windows Behavior Monitoring - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9494,7 +9674,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9516,7 +9696,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Windows SmartScreen Protection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9539,7 +9719,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9561,7 +9741,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling CMD Application - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9584,7 +9764,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9606,7 +9786,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling ControlPanel - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9629,7 +9809,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -9651,7 +9831,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling Firewall with Netsh - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9674,7 +9854,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9696,7 +9876,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling FolderOptions Windows Feature - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9764,7 +9944,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9786,7 +9966,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling NoRun Windows App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9809,7 +9989,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002", "T1548"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. @@ -9831,7 +10011,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling Remote User Account Control - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Remcos"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Remcos"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002", "T1548"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -9854,7 +10034,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep their infection on the box. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep their infection on the box. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9876,7 +10056,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling SystemRestore In Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9899,7 +10079,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -9921,7 +10101,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling Task Manager - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9944,7 +10124,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -9966,7 +10146,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Domain Account Discovery With Net App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9989,7 +10169,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover domain users. The `user` argument returns a list of all users registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover domain users. The `user` argument returns a list of all users registered in the domain. Red Teams and adversaries alike engage in remote system discovery for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -10011,7 +10191,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Domain Account Discovery with Dsquery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10034,7 +10214,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -10056,7 +10236,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Domain Account Discovery with Wmic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10169,7 +10349,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe to enumerate domain groups for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -10191,7 +10371,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Domain Group Discovery With Dsquery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10214,7 +10394,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `net.exe` with command-line arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate domain groups for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `net.exe` with command-line arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -10236,7 +10416,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Domain Group Discovery With Net - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10259,7 +10439,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. Red Teams and adversaries alike use wmic.exe to enumerate domain groups for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. Red Teams and adversaries alike use wmic.exe to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -10281,7 +10461,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Domain Group Discovery With Wmic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10304,7 +10484,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -10326,7 +10506,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Domain Group Discovery with Adsisearcher - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. @@ -10392,7 +10572,7 @@ search = `sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = " action.escu = 0 action.escu.enabled = 1 description = This search is to detect dropping a suspicious file named as "license.dat" in %appdata%. This behavior seen in latest IcedID malware that contain the actual core bot that will be injected in other process to do banking stealing. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204", "T1204.002"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect dropping a suspicious file named as "license.dat" in %appdata%. This behavior seen in latest IcedID malware that contain the actual core bot that will be injected in other process to do banking stealing. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -10414,7 +10594,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Drop IcedID License dat - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204", "T1204.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect dropping a suspicious file named as "license.dat" in %appdata%. This behavior seen in latest IcedID malware that contain the actual core bot that will be injected in other process to do banking stealing. @@ -10436,7 +10616,7 @@ search = `sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFi action.escu = 0 action.escu.enabled = 1 description = Detect the usage of comsvcs.dll for dumping the lsass process. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Detect the usage of comsvcs.dll for dumping the lsass process. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -10458,7 +10638,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via comsvcs DLL - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10482,7 +10662,7 @@ action.escu = 0 action.escu.enabled = 1 description = Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This query does not monitor for the internal name (original_file_name=procdump) of the PE or look for procdump64.exe. Modify the query as needed.\ During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This query does not monitor for the internal name (original_file_name=procdump) of the PE or look for procdump64.exe. Modify the query as needed.\ During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. @@ -10505,7 +10685,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via procdump - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10784,11 +10964,56 @@ realtime_schedule = 0 is_visible = false search = `cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success | stats earliest(_time) as firstTime latest(_time) as lastTime by userIdentity.arn | rename userIdentity.arn as arn | inputlookup append=t previously_seen_ec2_launches_by_user.csv | stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn | outputlookup previously_seen_ec2_launches_by_user.csv | eval newUser=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) | where newUser=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename arn as userIdentity.arn | table userIdentity.arn] | rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter` +[ESCU - ETW Registry Disabled - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.006", "T1127", "T1562"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-10-07 +action.escu.modification_date = 2021-10-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - ETW Registry Disabled - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation"] +action.risk = 1 +action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - ETW Registry Disabled - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation"], "confidence": 100, "context": ["source:endpoint", "stage:Privilege Escalation Persistence"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.006", "T1127", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. +action.notable.param.rule_title = ETW Registry Disabled +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*") Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `etw_registry_disabled_filter` + [ESCU - Elevated Group Discovery With Net - Rule] action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -10810,7 +11035,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Elevated Group Discovery With Net - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10833,7 +11058,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -10855,7 +11080,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Elevated Group Discovery With Wmic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10878,7 +11103,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -10900,7 +11125,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Elevated Group Discovery with PowerView - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. @@ -10964,7 +11189,7 @@ search = | tstats `security_content_summariesonly` count values(All_Email.recipi action.escu = 0 action.escu.enabled = 1 description = The search looks at the change-analysis data model and detects email files created outside the normal Outlook directory. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.001"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114", "T1114.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The search looks at the change-analysis data model and detects email files created outside the normal Outlook directory. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. @@ -10982,7 +11207,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Email files written outside of the Outlook directory - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114", "T1114.001"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -11005,7 +11230,7 @@ search = | tstats `security_content_summariesonly` count values(Filesystem.file_ action.escu = 0 action.escu.enabled = 1 description = This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server. -action.escu.mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114", "T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} action.escu.data_models = ["Network_Traffic"] action.escu.eli5 = This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server. action.escu.how_to_implement = This search requires you to be ingesting your network traffic and populating the Network_Traffic data model. Your email servers must be categorized as "email_server" for the search to work, as well. You may need to adjust the deviation_threshold and minimum_data_samples values based on the network traffic in your environment. The "deviation_threshold" field is a multiplying factor to control how much variation you're willing to tolerate. The "minimum_data_samples" field is the minimum number of connections of data samples required for the statistic to be valid. @@ -11023,7 +11248,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Email servers sending high volume traffic to hosts - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging", "HAFNIUM Group"], "cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging", "HAFNIUM Group"], "cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114", "T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server. @@ -11086,6 +11311,51 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter` +[ESCU - Enable WDigest UseLogonCredential Registry - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112", "T1003"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-10-05 +action.escu.modification_date = 2021-10-05 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Enable WDigest UseLogonCredential Registry - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Credential Dumping"] +action.risk = 1 +action.risk.param._risk_message = wdigest registry $registry_path$ was modified in $dest$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Enable WDigest UseLogonCredential Registry - Rule +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. +action.notable.param.rule_title = Enable WDigest UseLogonCredential Registry +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `enable_wdigest_uselogoncredential_registry_filter` + [ESCU - Enumerate Users Local Group Using Telegram - Rule] action.escu = 0 action.escu.enabled = 1 @@ -11134,7 +11404,7 @@ search = `wineventlog_security` EventCode=4798 Process_Name = "*\\telegram.exe" action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies the process - `esentutl.exe` - being used to capture credentials stored in ntds.dit or the SAM file on disk. During triage, review parallel processes and determine if legitimate activity. Upon determination of illegitimate activity, take further action to isolate and contain the threat. -action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation", "Lateral Movement"], "mitre_attack": ["T1003.002"]} +action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation", "Lateral Movement"], "mitre_attack": ["T1003.002", "T1003"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies the process - `esentutl.exe` - being used to capture credentials stored in ntds.dit or the SAM file on disk. During triage, review parallel processes and determine if legitimate activity. Upon determination of illegitimate activity, take further action to isolate and contain the threat. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -11156,7 +11426,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Esentutl SAM Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Privilege Escalation", "Lateral Movement"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Privilege Escalation", "Lateral Movement"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -11179,7 +11449,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary. -action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002", "T1548"]} action.escu.data_models = [] action.escu.eli5 = The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -11201,7 +11471,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Eventvwr UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -11224,7 +11494,7 @@ search = | tstats `security_content_summariesonly` count values(Registry.registr action.escu = 0 action.escu.enabled = 1 description = The following detection identifies Microsoft Excel spawning PowerShell. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from Excel.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies Microsoft Excel spawning PowerShell. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from Excel.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -11246,7 +11516,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excel Spawning PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -11269,7 +11539,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = The following detection identifies Microsoft Excel spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`. `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line executed will most likely be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies Microsoft Excel spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`. `cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line executed will most likely be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -11291,7 +11561,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excel Spawning Windows Script Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -11359,7 +11629,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = This search identifies DNS query failures by counting the number of DNS responses that do not indicate success, and trigger on more than 50 occurrences. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} action.escu.data_models = ["Network_Resolution"] action.escu.eli5 = This search identifies DNS query failures by counting the number of DNS responses that do not indicate success, and trigger on more than 50 occurrences. action.escu.how_to_implement = To successfully implement this search you must ensure that DNS data is populating the Network_Resolution data model. @@ -11377,7 +11647,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive DNS Failures - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search identifies DNS query failures by counting the number of DNS responses that do not indicate success, and trigger on more than 50 occurrences. @@ -11534,7 +11804,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application or to gain privilege escalation. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application or to gain privilege escalation. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. @@ -11552,7 +11822,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive Usage Of SC Service Utility - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569.002"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application or to gain privilege escalation. @@ -11574,7 +11844,7 @@ search = `sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m action.escu = 0 action.escu.enabled = 1 description = This analytic identifies excessive usage of `taskkill.exe` application. This application is commonly used by adversaries to evade detections by killing security product processes or even other processes to evade detection. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic identifies excessive usage of `taskkill.exe` application. This application is commonly used by adversaries to evade detections by killing security product processes or even other processes to evade detection. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. @@ -11596,7 +11866,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive Usage Of Taskkill - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -11708,7 +11978,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = [] action.escu.eli5 = This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -11730,7 +12000,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive number of service control start as disabled - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -11857,7 +12127,7 @@ description = The following analytic identifies the usage of Exchange PowerShell Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \ Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \ Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG). -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Currently, there is no active data shared or data we could re-produce relate to this part of the ProxyShell chain of exploits. \ Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \ @@ -11882,7 +12152,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Exchange PowerShell Module Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["ProxyShell"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["ProxyShell"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Currently, there is no active data shared or data we could re-produce relate to this part of the ProxyShell chain of exploits. \ @@ -11952,7 +12222,7 @@ search = |tstats `security_content_summariesonly` values(Filesystem.file_path) a action.escu = 0 action.escu.enabled = 1 description = This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.005"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this com object with combination of amsi disabling technique. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -11974,7 +12244,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Execute Javascript With Jscript COM CLSID - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.005"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12038,7 +12308,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. @@ -12060,7 +12330,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Execution of File with Multiple Extensions - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"], "cis20": ["CIS 3", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process", "role": ["Parent Process", "Attacker"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"], "cis20": ["CIS 3", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process", "role": ["Parent Process", "Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12124,7 +12394,7 @@ search = `netbackup` MESSAGE="Disk/Partition backup completed successfully." | s action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -12146,7 +12416,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Extraction of Registry Hives - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Credential Dumping"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Credential Dumping"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12259,7 +12529,7 @@ search = | tstats `security_content_summariesonly` min(_time) as firstTime value action.escu = 0 action.escu.enabled = 1 description = This search looks for the first and last time a Windows service is seen running in your environment. This table is then cached. -action.escu.mappings = {"cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569", "T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = This search looks for the first and last time a Windows service is seen running in your environment. This table is then cached. action.escu.how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows system event logs in order for this search to execute successfully. You should run the baseline search `Previously Seen Running Windows Services - Initial` to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search `Previously Seen Running Windows Services - Update` to keep this table up to date and to age out old Windows Services. Please update the `previously_seen_windows_services_window` macro to adjust the time window. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. @@ -12277,7 +12547,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - First Time Seen Running Windows Service - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Orangeworm Attack Group", "NOBELIUM Group"], "cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Orangeworm Attack Group", "NOBELIUM Group"], "cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569", "T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -12344,7 +12614,7 @@ description = Fodhelper.exe has a known UAC bypass as it attempts to look for sp 1. `HKCU:\Software\Classes\ms-settings\shell\open\command\DelegateExecute`\ 1. `HKCU:\Software\Classes\ms-settings\shell\open\command\(default)`\ Upon triage, fodhelper.exe will have a child process and read access will occur on the registry keys. Isolate the endpoint and review parallel processes for additional behavior. -action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1548.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1548.002", "T1548"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Fodhelper.exe has a known UAC bypass as it attempts to look for specific registry keys upon execution, that do not exist. Therefore, an attacker can write its malicious commands in these registry keys to be executed by fodhelper.exe with the highest privilege. \ 1. `HKCU:\Software\Classes\ms-settings\shell\open\command`\ @@ -12370,7 +12640,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - FodHelper UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1548.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1548.002", "T1548"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12723,13 +12993,13 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(gpupdate\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(gpupdate\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter` [ESCU - GSuite Email Suspicious Attachment - Rule] action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. @@ -12741,7 +13011,7 @@ action.escu.full_search_name = ESCU - GSuite Email Suspicious Attachment - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["DevSecOps"] +action.escu.analytic_story = ["Dev Sec Ops"] action.risk = 1 action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$ action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "destination{}.address", "risk_object_type": "user", "risk_score": 49}] @@ -12751,7 +13021,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GSuite Email Suspicious Attachment - Rule -action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin. @@ -12862,7 +13132,7 @@ search = `powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolic action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns a list of all domain users. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns a list of all domain users. Red Teams and adversaries alike may use this commandlet to identify remote systems for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -12884,7 +13154,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Get ADUser with PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12907,7 +13177,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -12929,7 +13199,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Get ADUser with PowerShell Script Block - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. @@ -13129,7 +13399,7 @@ search = `powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -13151,7 +13421,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Get DomainUser with PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13174,7 +13444,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -13196,7 +13466,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Get DomainUser with PowerShell Script Block - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. @@ -13218,7 +13488,7 @@ search = `powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count action.escu = 0 action.escu.enabled = 1 description = The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -13240,7 +13510,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Get WMIObject Group Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13265,7 +13535,7 @@ action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the usage of `Get-WMIObject Win32_Group`, which is typically used as a way to identify groups on the endpoint. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the usage of `Get-WMIObject Win32_Group`, which is typically used as a way to identify groups on the endpoint. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ @@ -13289,7 +13559,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ @@ -13592,7 +13862,7 @@ search = `powershell` EventCode=4104 (Message = "*Get-AdComputer*") | stats coun action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. Red Teams and adversaries alike may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. Red Teams and adversaries alike may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -13614,7 +13884,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetAdGroup with PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13637,7 +13907,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -13659,7 +13929,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetAdGroup with PowerShell Script Block - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. @@ -13948,7 +14218,7 @@ search = `powershell` EventCode=4104 (Message = "*Get-DomainController*") | stat action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -13970,7 +14240,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetDomainGroup with PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13993,7 +14263,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -14015,7 +14285,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetDomainGroup with PowerShell Script Block - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. @@ -14037,7 +14307,7 @@ search = `powershell` EventCode=4104 (Message = "*Get-DomainGroup*") | stats cou action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for local users. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for local users. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -14059,7 +14329,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetLocalUser with PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -14082,7 +14352,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -14104,7 +14374,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetLocalUser with PowerShell Script Block - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. @@ -14215,7 +14485,7 @@ search = `powershell` EventCode=4104 (Message = "*Get-NetTcpconnection*") | stat action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -14237,7 +14507,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetWmiObject DS User with PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -14260,7 +14530,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = he following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -14282,7 +14552,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetWmiObject DS User with PowerShell Script Block - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["source:endpoint", "stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery. @@ -14393,7 +14663,7 @@ search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"name action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -14415,7 +14685,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetWmiObject Ds Group with PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -14438,7 +14708,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -14460,7 +14730,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. @@ -14482,7 +14752,7 @@ search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"name action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -14504,7 +14774,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetWmiObject User Account with PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -14527,7 +14797,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -14549,7 +14819,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GetWmiObject User Account with PowerShell Script Block - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery. @@ -14571,7 +14841,7 @@ search = `powershell` EventCode=4104 (Message="*Get-WmiObject*" AND Message="*Wi action.escu = 0 action.escu.enabled = 1 description = This search looks for Dependabot Alerts in Github logs. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for Dependabot Alerts in Github logs. action.escu.how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. @@ -14593,7 +14863,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GitHub Dependabot Alert - Rule -action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repository", "role": ["Victim"], "type": "System"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repository", "role": ["Victim"], "type": "System"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -14616,7 +14886,7 @@ search = `github` alert.id=* action=create | rename repository.full_name as repo action.escu = 0 action.escu.enabled = 1 description = This search looks for Pull Request from unknown user. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for Pull Request from unknown user. action.escu.how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. @@ -14638,7 +14908,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GitHub Pull Request from Unknown User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repository", "role": ["Victim"], "type": "System"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repository", "role": ["Victim"], "type": "System"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -14673,7 +14943,7 @@ action.escu.full_search_name = ESCU - Github Commit Changes In Master - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["DevSecOps"] +action.escu.analytic_story = ["Dev Sec Ops"] action.risk = 1 action.risk.param._risk_message = suspicious commit by $commit.commit.author.email$ to main branch action.risk.param._risk = [{"risk_object_field": "commit.commit.author.email", "risk_object_type": "user", "risk_score": 9}] @@ -14683,7 +14953,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Github Commit Changes In Master - Rule -action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"], "observable": [{"name": "commit.commit.author.email", "role": ["attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"], "observable": [{"name": "commit.commit.author.email", "role": ["attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a pushed or commit to master or main branch. This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch @@ -14717,7 +14987,7 @@ action.escu.full_search_name = ESCU - Github Commit In Develop - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["DevSecOps"] +action.escu.analytic_story = ["Dev Sec Ops"] action.risk = 1 action.risk.param._risk_message = suspicious commit by $commit.commit.author.email$ to develop branch action.risk.param._risk = [{"risk_object_field": "commit.commit.author.email", "risk_object_type": "user", "risk_score": 9}] @@ -14727,7 +14997,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Github Commit In Develop - Rule -action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"], "observable": [{"name": "commit.commit.author.email", "role": ["attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"], "observable": [{"name": "commit.commit.author.email", "role": ["attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a pushed or commit to develop branch. This is to avoid unwanted modification to develop without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a PR for review. of course in some cases admin of the project may did a changes directly to master branch @@ -14749,10 +15019,10 @@ search = `github` branches{}.name = main OR branches{}.name = develop | stats c action.escu = 0 action.escu.enabled = 1 description = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. -action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002", "T1567"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. action.escu.known_false_positives = network admin or normal user may share files to customer and external team. action.escu.creation_date = 2021-08-16 action.escu.modification_date = 2021-08-16 @@ -14761,7 +15031,7 @@ action.escu.full_search_name = ESCU - Gsuite Drive Share In External Email - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["DevSecOps"] +action.escu.analytic_story = ["Dev Sec Ops"] action.risk = 1 action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "email", "risk_object_type": "user", "risk_score": 72}] @@ -14771,7 +15041,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Gsuite Drive Share In External Email - Rule -action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 80, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 80, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002", "T1567"], "observable": [{"name": "parameters.owner", "role": ["Attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -14794,7 +15064,7 @@ search = `gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner action.escu = 0 action.escu.enabled = 1 description = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. @@ -14806,7 +15076,7 @@ action.escu.full_search_name = ESCU - Gsuite Email Suspicious Subject With Attac action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["DevSecOps"] +action.escu.analytic_story = ["Dev Sec Ops"] action.risk = 1 action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$ action.risk.param._risk = [] @@ -14816,7 +15086,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Gsuite Email Suspicious Subject With Attachment - Rule -action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail. @@ -14838,7 +15108,7 @@ search = `gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups action.escu = 0 action.escu.enabled = 1 description = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]} action.escu.data_models = [] action.escu.eli5 = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. @@ -14850,7 +15120,7 @@ action.escu.full_search_name = ESCU - Gsuite Email With Known Abuse Web Service action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["DevSecOps"] +action.escu.analytic_story = ["Dev Sec Ops"] action.risk = 1 action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$ action.risk.param._risk = [] @@ -14860,7 +15130,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Gsuite Email With Known Abuse Web Service Link - Rule -action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services. @@ -14882,7 +15152,7 @@ search = `gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*tel action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. @@ -14894,7 +15164,7 @@ action.escu.full_search_name = ESCU - Gsuite Outbound Email With Attachment To E action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["DevSecOps"] +action.escu.analytic_story = ["Dev Sec Ops"] action.risk = 1 action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$ action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 9}, {"risk_object_field": "destination{}.address", "risk_object_type": "user", "risk_score": 9}] @@ -14904,7 +15174,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule -action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment. @@ -14926,10 +15196,10 @@ search = `gsuite_gmail` num_message_attachments > 0 | rex field=source.from_head action.escu = 0 action.escu.enabled = 1 description = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. action.escu.known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search action.escu.creation_date = 2021-08-23 action.escu.modification_date = 2021-08-23 @@ -14938,7 +15208,7 @@ action.escu.full_search_name = ESCU - Gsuite Suspicious Shared File Name - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["DevSecOps"] +action.escu.analytic_story = ["Dev Sec Ops"] action.risk = 1 action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 21}, {"risk_object_field": "email", "risk_object_type": "user", "risk_score": 21}] @@ -14948,7 +15218,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Gsuite Suspicious Shared File Name - Rule -action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -14971,7 +15241,7 @@ search = `gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit action.escu = 0 action.escu.enabled = 1 description = This analytic identifies a suspicious registry modification to hide a user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will create a hidden user account with Admin privileges in login screen to avoid noticing by the user that they already compromise and to persist on that said machine. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = [] action.escu.eli5 = This analytic identifies a suspicious registry modification to hide a user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will create a hidden user account with Admin privileges in login screen to avoid noticing by the user that they already compromise and to persist on that said machine. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. @@ -14993,7 +15263,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Hide User Account From Sign-In Screen - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "registry_value_name", "role": ["Attacker"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "registry_value_name", "role": ["Attacker"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -15016,7 +15286,7 @@ search = | tstats `security_content_summariesonly` count values(Registry.registr action.escu = 0 action.escu.enabled = 1 description = Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe to hide files. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222", "T1222.001"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe to hide files. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -15038,7 +15308,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Hiding Files And Directories With Attrib exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Attacker", "Parent Process"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222", "T1222.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Attacker", "Parent Process"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -15106,7 +15376,7 @@ search = `sysmon` EventCode=23 TargetFilename IN ("*\.cmd", "*\.ini","*\.gif", " action.escu = 0 action.escu.enabled = 1 description = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. -action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001", "T1110"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. action.escu.how_to_implement = @@ -15124,7 +15394,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - High Number of Login Failures from a single source - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001", "T1110"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -15191,7 +15461,7 @@ search = `sysmon` EventCode=5 |bin _time span=3s |stats values(Image) as proc_te action.escu = 0 action.escu.enabled = 1 description = This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server. -action.escu.mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} action.escu.data_models = ["Network_Traffic"] action.escu.eli5 = This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server. action.escu.how_to_implement = This search requires you to be ingesting your network traffic and populating the Network_Traffic data model. Your email servers must be categorized as "email_server" for the search to work, as well. You may need to adjust the deviation_threshold and minimum_data_samples values based on the network traffic in your environment. The "deviation_threshold" field is a multiplying factor to control how much variation you're willing to tolerate. The "minimum_data_samples" field is the minimum number of connections of data samples required for the statistic to be valid. @@ -15209,7 +15479,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Hosts receiving high volume of network traffic from email server - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server. @@ -15321,7 +15591,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious file creation namely passff.tar and cookie.tar. This files are possible archived of stolen browser information like history and cookies in a compromised machine with IcedID. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a suspicious file creation namely passff.tar and cookie.tar. This files are possible archived of stolen browser information like history and cookies in a compromised machine with IcedID. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -15343,7 +15613,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - IcedID Exfiltrated Archived File Creation - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a suspicious file creation namely passff.tar and cookie.tar. This files are possible archived of stolen browser information like history and cookies in a compromised machine with IcedID. @@ -15405,7 +15675,7 @@ search = | from datamodel Identity_Management.All_Identities | eval empStatus=c action.escu = 0 action.escu.enabled = 1 description = This search is to detect a execution of jscript using cscript process. Commonly when a user run jscript file it was executed by wscript.exe application. This technique was seen in FIN7 js implant to execute its malicious script using cscript process. This behavior is uncommon and a good artifacts to check further anomalies within the network -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a execution of jscript using cscript process. Commonly when a user run jscript file it was executed by wscript.exe application. This technique was seen in FIN7 js implant to execute its malicious script using cscript process. This behavior is uncommon and a good artifacts to check further anomalies within the network action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -15427,7 +15697,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Jscript Execution Using Cscript App - Rule -action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -15450,7 +15720,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search detects a potential kerberoasting attack via service principal name requests -action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558.003", "T1558"], "nist": ["DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search detects a potential kerberoasting attack via service principal name requests action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, and include the windows security event logs that contain kerberos @@ -15472,7 +15742,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kerberoasting spn request with RC4 encryption - Rule -action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 8", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 8", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558.003", "T1558"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects a potential kerberoasting attack via service principal name requests @@ -16438,7 +16708,7 @@ search = `kube_objects_events` object.message IN ("Pulling image *kube-hunter*", action.escu = 0 action.escu.enabled = 1 description = The search is used to identify attempts to use your DNS Infrastructure for DDoS purposes via a DNS amplification attack leveraging ANY queries. -action.escu.mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498.002"], "nist": ["PR.PT", "DE.AE", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498", "T1498.002"], "nist": ["PR.PT", "DE.AE", "PR.IP"]} action.escu.data_models = ["Network_Resolution"] action.escu.eli5 = The search is used to identify attempts to use your DNS Infrastructure for DDoS purposes via a DNS amplification attack leveraging ANY queries. action.escu.how_to_implement = To successfully implement this search you must ensure that DNS data is populating the Network_Resolution data model. @@ -16456,7 +16726,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Large Volume of DNS ANY Queries - Rule -action.correlationsearch.annotations = {"analytic_story": ["DNS Amplification Attacks"], "cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498.002"], "nist": ["PR.PT", "DE.AE", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["DNS Amplification Attacks"], "cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498", "T1498.002"], "nist": ["PR.PT", "DE.AE", "PR.IP"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The search is used to identify attempts to use your DNS Infrastructure for DDoS purposes via a DNS amplification attack leveraging ANY queries. @@ -16478,7 +16748,7 @@ search = | tstats `security_content_summariesonly` count from datamodel=Network_ action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -16500,7 +16770,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Local Account Discovery With Wmic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -16523,7 +16793,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -16545,7 +16815,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Local Account Discovery with Net - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -16564,11 +16834,56 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process=*user OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter` +[ESCU - Logon Script Event Trigger Execution - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1037", "T1037.001"]} +action.escu.data_models = [] +action.escu.eli5 = This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-09-27 +action.escu.modification_date = 2021-09-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Logon Script Event Trigger Execution - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation"] +action.risk = 1 +action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Logon Script Event Trigger Execution - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation"], "confidence": 100, "context": ["source:endpoint", "stage:Privilege Escalation Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1037", "T1037.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine. +action.notable.param.rule_title = Logon Script Event Trigger Execution +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter` + [ESCU - MS Scripting Process Loading Ldap Module - Rule] action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading ldap module to process ldap query. This behavior was seen in FIN7 implant where it uses javascript to execute ldap query to parse host information that will send to its C2 server. this anomaly detections is a good initial step to hunt further a suspicious ldap query or ldap related events to the host that may give you good information regarding ldap or AD information processing or might be a attacker. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading ldap module to process ldap query. This behavior was seen in FIN7 implant where it uses javascript to execute ldap query to parse host information that will send to its C2 server. this anomaly detections is a good initial step to hunt further a suspicious ldap query or ldap related events to the host that may give you good information regarding ldap or AD information processing or might be a attacker. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. @@ -16590,7 +16905,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - MS Scripting Process Loading Ldap Module - Rule -action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading ldap module to process ldap query. This behavior was seen in FIN7 implant where it uses javascript to execute ldap query to parse host information that will send to its C2 server. this anomaly detections is a good initial step to hunt further a suspicious ldap query or ldap related events to the host that may give you good information regarding ldap or AD information processing or might be a attacker. @@ -16612,7 +16927,7 @@ search = `sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") Ima action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading wmi module to process wmi query. This behavior was seen in FIN7 implant where it uses javascript to execute wmi query to parse host information that will send to its C2 server. this anomaly detections is a good initial step to hunt further a suspicious wmi query or wmi related events to the host that may give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading wmi module to process wmi query. This behavior was seen in FIN7 implant where it uses javascript to execute wmi query to parse host information that will send to its C2 server. this anomaly detections is a good initial step to hunt further a suspicious wmi query or wmi related events to the host that may give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. @@ -16634,7 +16949,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - MS Scripting Process Loading WMI Module - Rule -action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading wmi module to process wmi query. This behavior was seen in FIN7 implant where it uses javascript to execute wmi query to parse host information that will send to its C2 server. this anomaly detections is a good initial step to hunt further a suspicious wmi query or wmi related events to the host that may give you good information regarding process that are commonly using wmi query or modules or might be an attacker using this technique. @@ -16652,11 +16967,56 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter` +[ESCU - MSBuild Suspicious Spawned By Script Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the compromised host. During triage, review parallel processes and identify any file modifications. MSBuild may load a script from the same path without having command-line arguments. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1127"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the compromised host. During triage, review parallel processes and identify any file modifications. MSBuild may load a script from the same path without having command-line arguments. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives should be limited as developers do not spawn MSBuild via a WSH. +action.escu.creation_date = 2021-10-04 +action.escu.modification_date = 2021-10-04 +action.escu.confidence = high +action.escu.full_search_name = ESCU - MSBuild Suspicious Spawned By Script Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild"] +action.risk = 1 +action.risk.param._risk_message = Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - MSBuild Suspicious Spawned By Script Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "confidence": 70, "context": ["Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1127"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the compromised host. During triage, review parallel processes and identify any file modifications. MSBuild may load a script from the same path without having command-line arguments. +action.notable.param.rule_title = MSBuild Suspicious Spawned By Script Process +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("wscript.exe", "cscript.exe") AND `process_msbuild` by Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter` + [ESCU - MSHTML Module Load in Office Product - Rule] action.escu = 0 action.escu.enabled = 1 description = The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = [] action.escu.eli5 = The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -16678,7 +17038,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - MSHTML Module Load in Office Product - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -16742,7 +17102,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114", "T1114.001"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -16764,7 +17124,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Mailsniper Invoke functions - Rule -action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114", "T1114.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. @@ -16782,17 +17142,62 @@ realtime_schedule = 0 is_visible = false search = `powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mailsniper_invoke_functions_filter` +[ESCU - Malicious InProcServer32 Modification - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID). Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.010", "T1112"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID). Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line. +action.escu.creation_date = 2021-10-05 +action.escu.modification_date = 2021-10-05 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Malicious InProcServer32 Modification - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Remcos"] +action.risk = 1 +action.risk.param._risk_message = The $process_name$ was identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Malicious InProcServer32 Modification - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Remcos"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.010", "T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID). Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process. +action.notable.param.rule_title = Malicious InProcServer32 Modification +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest Registry.process_guid Registry.user | `drop_dm_object_name(Registry)` | fields _time dest registry_path registry_key_name registry_value_name process_name process_path process process_guid user] | stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name registry_path registry_key_name registry_value_name user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter` + [ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for PowerShell processes started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet. This combination of command-line options is suspicious because it's overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Deprecated becaue hidden is not needed when download file with System.Net.WebClient. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +description = The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Removed in this version of the query is New-Object. The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001", "T1059"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search looks for PowerShell processes started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet. This combination of command-line options is suspicious because it's overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Deprecated becaue hidden is not needed when download file with System.Net.WebClient. -action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.eli5 = The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Removed in this version of the query is New-Object. The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. +action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. action.escu.known_false_positives = Legitimate process can have this combination of command-line options, but it's not common. -action.escu.creation_date = 2020-11-20 -action.escu.modification_date = 2020-11-20 +action.escu.creation_date = 2021-10-05 +action.escu.modification_date = 2021-10-05 action.escu.confidence = high action.escu.full_search_name = ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule action.escu.search_type = detection @@ -16808,11 +17213,11 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Attacker"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001", "T1059"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for PowerShell processes started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet. This combination of command-line options is suspicious because it's overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Deprecated becaue hidden is not needed when download file with System.Net.WebClient. +action.notable.param.rule_description = The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Removed in this version of the query is New-Object. The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. action.notable.param.rule_title = Malicious PowerShell Process - Connect To Internet With Hidden Window action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -16825,19 +17230,25 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*" by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|||]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter` [ESCU - Malicious PowerShell Process - Encoded Command - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for PowerShell processes that have encoded the script within the command-line. Malware has been seen using this parameter, as it obfuscates the code and makes it relatively easy to pass a script on the command-line. +description = The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \ +The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \ +During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \ +Alternatively, may use regex per matching here https://regexr.com/662ov. action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search looks for PowerShell processes that have encoded the script within the command-line. Malware has been seen using this parameter, as it obfuscates the code and makes it relatively easy to pass a script on the command-line. +action.escu.eli5 = The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \ +The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \ +During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \ +Alternatively, may use regex per matching here https://regexr.com/662ov. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = System administrators may use this option, but it's not common. -action.escu.creation_date = 2020-07-21 -action.escu.modification_date = 2020-07-21 +action.escu.creation_date = 2021-10-05 +action.escu.modification_date = 2021-10-05 action.escu.confidence = high action.escu.full_search_name = ESCU - Malicious PowerShell Process - Encoded Command - Rule action.escu.search_type = detection @@ -16857,7 +17268,10 @@ action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for PowerShell processes that have encoded the script within the command-line. Malware has been seen using this parameter, as it obfuscates the code and makes it relatively easy to pass a script on the command-line. +action.notable.param.rule_description = The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \ +The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \ +During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \ +Alternatively, may use regex per matching here https://regexr.com/662ov. action.notable.param.rule_title = Malicious PowerShell Process - Encoded Command action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -16870,13 +17284,13 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process=*-EncodedCommand* OR Processes.process=*-enc*) by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `malicious_powershell_process___encoded_command_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|||]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]") | `malicious_powershell_process___encoded_command_filter` [ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule] action.escu = 0 action.escu.enabled = 1 description = This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed in attacks leveraging PowerShell scripts as they override the default PowerShell execution policy. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed in attacks leveraging PowerShell scripts as they override the default PowerShell execution policy. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -16898,7 +17312,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -16962,7 +17376,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -16984,7 +17398,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -17007,7 +17421,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. -action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"]} +action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569", "T1569.002"]} action.escu.data_models = [] action.escu.eli5 = This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. @@ -17029,7 +17443,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious Powershell Executed As A Service - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious Powershell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious Powershell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569", "T1569.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -17221,7 +17635,7 @@ search = | tstats `security_content_summariesonly` values(All_Email.recipient) a action.escu = 0 action.escu.enabled = 1 description = This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010", "T1547"], "nist": ["PR.PT", "DE.CM", "PR.AC"]} action.escu.data_models = [] action.escu.eli5 = This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. @@ -17243,7 +17657,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Monitor Registry Keys for Print Monitors - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8", "CIS 5"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8", "CIS 5"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010", "T1547"], "nist": ["PR.PT", "DE.CM", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -17307,7 +17721,7 @@ search = | tstats `security_content_summariesonly` values(Web.url) as urls min(_ action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -17329,7 +17743,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "IcedID"], "confidence": 80, "context": ["source:endpoint", {"stage": "executions"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "IcedID"], "confidence": 80, "context": ["source:endpoint", {"stage": "executions"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -17352,7 +17766,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version of msmpeng.exe to load the actual payload name as mspvc.dll which will load the revil ransomware to the compromise machine action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -17370,7 +17784,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Msmpeng Application DLL Side Loading - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -17393,7 +17807,7 @@ search = |tstats `security_content_summariesonly` values(Filesystem.file_path) a action.escu = 0 action.escu.enabled = 1 description = This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its C2 through HTTP POST. Sometimes adversaries will rename the archive files or encode/encrypt to cover their tracks. This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration. -action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003", "T1048"]} action.escu.data_models = [] action.escu.eli5 = This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its C2 through HTTP POST. Sometimes adversaries will rename the archive files or encode/encrypt to cover their tracks. This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled in stream http configuration. @@ -17415,7 +17829,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Archive Files Http Post Traffic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "UriPath"}, {"name": "form_data", "role": ["Attacker"], "type": "formdata"}]} +action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003", "T1048"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "UriPath"}, {"name": "form_data", "role": ["Attacker"], "type": "formdata"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its C2 through HTTP POST. Sometimes adversaries will rename the archive files or encode/encrypt to cover their tracks. This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration. @@ -17440,7 +17854,7 @@ description = The following analytic identifies one source endpoint failing to a The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ This detection will only trigger on domain controllers, not on member servers or workstations.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ @@ -17465,7 +17879,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ @@ -17493,7 +17907,7 @@ description = The following analytic identifies one source endpoint failing to a The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ This detection will only trigger on domain controllers, not on member servers or workstations.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ @@ -17518,7 +17932,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ @@ -17546,7 +17960,7 @@ description = The following analytic identifies one source endpoint failing to a The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ This detection will only trigger on domain controllers, not on member servers or workstations.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ @@ -17571,7 +17985,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ @@ -17596,7 +18010,7 @@ search = `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 a action.escu = 0 action.escu.enabled = 1 description = This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. -action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. action.escu.how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. @@ -17614,7 +18028,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. @@ -17639,7 +18053,7 @@ description = The following analytic identifies a source user failing to authent The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ @@ -17664,7 +18078,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ @@ -17692,7 +18106,7 @@ description = The following analytic identifies one source endpoint failing to a The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ This detection will only trigger on domain controllers, not on member servers or workstations.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ @@ -17717,7 +18131,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ @@ -17745,7 +18159,7 @@ description = The following analytic identifies one source endpoint failing to a The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ This detection will only trigger on domain controllers, not on member servers or workstations.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ @@ -17770,7 +18184,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ @@ -17798,7 +18212,7 @@ description = The following analytic identifies a source process name failing to The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server or workstation.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ @@ -17823,7 +18237,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ @@ -17851,7 +18265,7 @@ description = The following analytic identifies a source host failing to authent The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\ The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ @@ -17876,7 +18290,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ @@ -17901,7 +18315,7 @@ search = `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Addr action.escu = 0 action.escu.enabled = 1 description = This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -17923,7 +18337,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - NET Profiler UAC bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -17991,7 +18405,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following hunting analytic will identify the use of localgroup discovery using `net localgroup`. During triage, review parallel processes and identify any further suspicious behavior. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following hunting analytic will identify the use of localgroup discovery using `net localgroup`. During triage, review parallel processes and identify any further suspicious behavior. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -18013,7 +18427,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Net Localgroup Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18212,7 +18626,7 @@ search = | tstats count min(_time) as firstTime max(_time) as lastTime FROM data action.escu = 0 action.escu.enabled = 1 description = This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a call back to a remote command and control server. This is a powershell oneliner. In addition, this will capture on the command-line additional utilities used by Nishang. Triage the endpoint and identify any parallel processes that look suspicious. Review the reputation of the remote IP or domain contacted by the powershell process. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a call back to a remote command and control server. This is a powershell oneliner. In addition, this will capture on the command-line additional utilities used by Nishang. Triage the endpoint and identify any parallel processes that look suspicious. Review the reputation of the remote IP or domain contacted by the powershell process. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -18234,7 +18648,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Nishang PowershellTCPOneLine - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command and Control"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command and Control"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18298,7 +18712,7 @@ search = | tstats `security_content_summariesonly` max(_time) as lastTime from d action.escu = 0 action.escu.enabled = 1 description = This search is to detect an anomaly event of non-chrome process accessing the files in chrome user default folder. This folder contains all the sqlite database of the chrome browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555", "T1555.003"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect an anomaly event of non-chrome process accessing the files in chrome user default folder. This folder contains all the sqlite database of the chrome browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable. action.escu.how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." @@ -18320,7 +18734,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Non Chrome Process Accessing Chrome Default Dir - Rule -action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555", "T1555.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18343,7 +18757,7 @@ search = `wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome. action.escu = 0 action.escu.enabled = 1 description = This search is to detect an anomaly event of non-firefox process accessing the files in profile folder. This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555", "T1555.003"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect an anomaly event of non-firefox process accessing the files in profile folder. This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring this access to the folder a noise coming from firefox need to be filter and also sqlite db browser and explorer .exe to make this detection more stable. action.escu.how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." @@ -18365,7 +18779,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Non Firefox Process Access Firefox Profile Dir - Rule -action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555", "T1555.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18390,7 +18804,7 @@ action.escu.enabled = 1 description = Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical command used to dump ntds.dit \ ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \ This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical command used to dump ntds.dit \ ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \ @@ -18414,7 +18828,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Ntdsutil Export NTDS - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18439,7 +18853,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. -action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]} action.escu.data_models = [] action.escu.eli5 = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity @@ -18461,7 +18875,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Add App Role Assignment Grant User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Actor.ID", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Actor.ID", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -18478,7 +18892,7 @@ search = `o365_management_activity` Workload=AzureActiveDirectory Operation="Add action.escu = 0 action.escu.enabled = 1 description = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. -action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]} action.escu.data_models = [] action.escu.eli5 = This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity @@ -18500,7 +18914,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Added Service Principal - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Target.ID", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Target.ID", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -18517,7 +18931,7 @@ search = `o365_management_activity` Workload=AzureActiveDirectory signature="Add action.escu = 0 action.escu.enabled = 1 description = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. -action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007"]} +action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007", "T1562"]} action.escu.data_models = [] action.escu.eli5 = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. action.escu.how_to_implement = You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity @@ -18539,7 +18953,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Bypass MFA via Trusted IP - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007"], "observable": [{"name": "ip_addresses_new_added", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_id", "role": ["Attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007", "T1562"], "observable": [{"name": "ip_addresses_new_added", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_id", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -18673,7 +19087,7 @@ search = `o365_management_activity` Workload=AzureActiveDirectory LogonError=Ss action.escu = 0 action.escu.enabled = 1 description = This search detects the addition of a new Federated domain. -action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"]} action.escu.data_models = [] action.escu.eli5 = This search detects the addition of a new Federated domain. action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity. @@ -18695,7 +19109,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 New Federated Domain Added - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "OrganizationName", "role": ["Victim"], "type": "Other"}, {"name": "UserId", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003", "T1136"], "observable": [{"name": "OrganizationName", "role": ["Victim"], "type": "Other"}, {"name": "UserId", "role": ["Victim"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -18751,7 +19165,7 @@ search = `o365_management_activity` Category=ThreatManagement Name="eDiscovery s action.escu = 0 action.escu.enabled = 1 description = This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination. -action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination. action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity @@ -18773,7 +19187,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Suspicious Admin Email Forwarding - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Exfiltration"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Exfiltration"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -18790,7 +19204,7 @@ search = `o365_management_activity` Operation=Set-Mailbox | spath input=Paramete action.escu = 0 action.escu.enabled = 1 description = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account. -action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account. action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity @@ -18812,7 +19226,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Suspicious Rights Delegation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -18829,7 +19243,7 @@ search = `o365_management_activity` Operation=Add-MailboxPermission | spath inpu action.escu = 0 action.escu.enabled = 1 description = This search detects when multiple user configured a forwarding rule to the same destination. -action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = This search detects when multiple user configured a forwarding rule to the same destination. action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity @@ -18851,7 +19265,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Suspicious User Email Forwarding - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "ForwardingSmtpAddress", "role": ["Other"], "type": "Email Address"}]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "ForwardingSmtpAddress", "role": ["Other"], "type": "Email Address"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -18868,7 +19282,7 @@ search = `o365_management_activity` Operation=Set-Mailbox | spath input=Paramete action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious MS office application that drop or create executables or script in the host. This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen in normal office application -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a suspicious MS office application that drop or create executables or script in the host. This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised the host. It might be some normal macro may drop script or tools as part of automation but still this behavior is reallly suspicious and not commonly seen in normal office application action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. @@ -18890,7 +19304,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Application Drop Executable - Rule -action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 80, "context": ["Source:Endpoint", "Stage:recon"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +action.correlationsearch.annotations = {"analytic_story": ["FIN7"], "confidence": 80, "context": ["Source:Endpoint", "Stage:recon"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -18913,7 +19327,7 @@ search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint action.escu = 0 action.escu.enabled = 1 description = this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like IcedID that used MS office as its weapon or attack vector to initially infect the machines. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like IcedID that used MS office as its weapon or attack vector to initially infect the machines. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -18935,7 +19349,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Application Spawn Regsvr32 process - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18958,7 +19372,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack vector to initially infect the machines. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack vector to initially infect the machines. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -18980,7 +19394,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Application Spawn rundll32 process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot", "IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot", "IcedID"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19003,7 +19417,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. This technique was seen in so many malicious macro malware that create persistence , beaconing using task schedule malware entry The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = [] action.escu.eli5 = this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. This technique was seen in so many malicious macro malware that create persistence , beaconing using task schedule malware entry The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. @@ -19025,7 +19439,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Document Creating Schedule Task - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. This technique was seen in so many malicious macro malware that create persistence , beaconing using task schedule malware entry The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' @@ -19047,7 +19461,7 @@ search = `sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWE action.escu = 0 action.escu.enabled = 1 description = this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office document as an attachment that may execute malicious payload, download malware payload or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = [] action.escu.eli5 = this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office document as an attachment that may execute malicious payload, download malware payload or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. @@ -19069,7 +19483,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Document Executing Macro Code - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot", "IcedID"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot", "IcedID"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office document as an attachment that may execute malicious payload, download malware payload or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. @@ -19091,7 +19505,7 @@ search = `sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWE action.escu = 0 action.escu.enabled = 1 description = This search is to detect potential malicious office document executing lolbin child process to download payload or other malware. Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect potential malicious office document executing lolbin child process to download payload or other malware. Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances office application and browser may be used. @@ -19113,7 +19527,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Document Spawned Child Process To Download - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19136,7 +19550,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -19158,7 +19572,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Product Spawn CMD Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["source:endpoint", {"stage": "executions"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["source:endpoint", {"stage": "executions"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19181,7 +19595,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line arguments as transfer, Download, priority, Foreground. In addition, Threat Research has released a detections identifying suspicious use of `bitsadmin.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line arguments as transfer, Download, priority, Foreground. In addition, Threat Research has released a detections identifying suspicious use of `bitsadmin.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -19203,7 +19617,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Product Spawning BITSAdmin - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19226,7 +19640,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `certutil.exe`. In malicious instances, the command-line of `certutil.exe` will contain a URL to a remote destination. In addition, Threat Research has released a detections identifying suspicious use of `certutil.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `certutil.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `certutil.exe`. In malicious instances, the command-line of `certutil.exe` will contain a URL to a remote destination. In addition, Threat Research has released a detections identifying suspicious use of `certutil.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `certutil.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -19248,7 +19662,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Product Spawning CertUtil - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19271,7 +19685,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `mshta.exe`. In malicious instances, the command-line of `mshta.exe` will contain the `hta` file locally, or a URL to the remote destination. In addition, Threat Research has released a detections identifying suspicious use of `mshta.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `mshta.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `mshta.exe`. In malicious instances, the command-line of `mshta.exe` will contain the `hta` file locally, or a URL to the remote destination. In addition, Threat Research has released a detections identifying suspicious use of `mshta.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `mshta.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -19293,7 +19707,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Product Spawning MSHTA - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "IcedID"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "IcedID"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19316,7 +19730,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following detection identifies the latest behavior utilized by IcedID malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. In addition, Threat Research has released a detection identifying the use of `DllRegisterServer` on the command-line of `rundll32.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze the `DLL` that was dropped to disk. The Office Product will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies the latest behavior utilized by IcedID malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. In addition, Threat Research has released a detection identifying the use of `DllRegisterServer` on the command-line of `rundll32.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze the `DLL` that was dropped to disk. The Office Product will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -19338,7 +19752,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Product Spawning Rundll32 with no DLL - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19361,7 +19775,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following detection identifies the latest behavior utilized by Ursnif malware family. This detection identifies any Windows Office Product spawning `wmic.exe`. In malicious instances, the command-line of `wmic.exe` will contain `wmic process call create`. In addition, Threat Research has released a detection identifying the use of `wmic process call create` on the command-line of `wmic.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies the latest behavior utilized by Ursnif malware family. This detection identifies any Windows Office Product spawning `wmic.exe`. In malicious instances, the command-line of `wmic.exe` will contain `wmic process call create`. In addition, Threat Research has released a detection identifying the use of `wmic process call create` on the command-line of `wmic.exe`. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination, capture and block the IPs or domain. Review additional parallel processes for further activity. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -19383,7 +19797,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Product Spawning Wmic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "FIN7"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "FIN7"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19406,7 +19820,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. @@ -19428,7 +19842,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Product Writing cab or inf - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -19451,7 +19865,7 @@ search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint action.escu = 0 action.escu.enabled = 1 description = The following detection identifies control.exe spawning from an office product. This detection identifies any Windows Office Product spawning `control.exe`. In malicious instances, the command-line of `control.exe` will contain a file path to a .cpl or .inf, related to CVE-2021-40444. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. review parallel and child processes to identify further suspicious behavior -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies control.exe spawning from an office product. This detection identifies any Windows Office Product spawning `control.exe`. In malicious instances, the command-line of `control.exe` will contain a file path to a .cpl or .inf, related to CVE-2021-40444. In this instance, we narrow our detection down to the Office suite as a parent process. During triage, review all file modifications. Capture and analyze any artifacts on disk. review parallel and child processes to identify further suspicious behavior action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -19473,7 +19887,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Spawning Control - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19496,7 +19910,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = Detect Okta user lockout events -action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} action.escu.data_models = [] action.escu.eli5 = Detect Okta user lockout events action.escu.how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. @@ -19514,7 +19928,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Okta Account Lockout Events - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = Detect Okta user lockout events @@ -19536,7 +19950,7 @@ search = `okta` displayMessage="Max sign in attempts exceeded" | rename client.g action.escu = 0 action.escu.enabled = 1 description = Detect failed Okta SSO events -action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} action.escu.data_models = [] action.escu.eli5 = Detect failed Okta SSO events action.escu.how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. @@ -19554,7 +19968,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Okta Failed SSO Attempts - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = Detect failed Okta SSO events @@ -19576,7 +19990,7 @@ search = `okta` displayMessage="User attempted unauthorized access to app" | sta action.escu = 0 action.escu.enabled = 1 description = This search detects logins from the same user from different cities in a 24 hour period. -action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search detects logins from the same user from different cities in a 24 hour period. action.escu.how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment. @@ -19594,7 +20008,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Okta User Logins From Multiple Cities - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -19635,7 +20049,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Deprecated - Open Redirect in Splunk Web - Rule -action.correlationsearch.annotations = {"analytic_story": ["Splunk Enterprise Vulnerability"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Splunk Enterprise Vulnerability"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "cve": ["CVE-2016-4859"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search allows you to look for evidence of exploitation for CVE-2016-4859, the Splunk Open Redirect Vulnerability. @@ -19697,7 +20111,7 @@ search = | from datamodel Alerts.Alerts | search app=osquery:results (name=pack_ action.escu = 0 action.escu.enabled = 1 description = Microsoft Windows contains accessibility features that can be launched with a key combination before a user has logged in. An adversary can modify or replace these programs so they can get a command prompt or backdoor without logging in to the system. This search looks for modifications to these binaries. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.008"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546", "T1546.008"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Microsoft Windows contains accessibility features that can be launched with a key combination before a user has logged in. An adversary can modify or replace these programs so they can get a command prompt or backdoor without logging in to the system. This search looks for modifications to these binaries. action.escu.how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. @@ -19719,7 +20133,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Overwriting Accessibility Binaries - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "privilege escalation"}], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.008"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Attacker"], "type": "file_path"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "privilege escalation"}], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546", "T1546.008"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Attacker"], "type": "file_path"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19860,7 +20274,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - PetitPotam Network Share Access Request - Rule -action.correlationsearch.annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1187"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access"], "cve": ["CVE-2021-36942"], "impact": 80, "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1187"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes Windows Event Code 5145, "A network share object was checked to see whether client can be granted desired access". During our research into PetitPotam, CVE-2021-36942, we identified the ocurrence of this event on the target host with specific values. \ @@ -19907,7 +20321,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - PetitPotam Suspicious Kerberos TGT Request - Rule -action.correlationsearch.annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access"], "cve": ["CVE-2021-36942"], "impact": 80, "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifes Event Code 4768, A `Kerberos authentication ticket (TGT) was requested`, successfull occurs. This behavior has been identified to assist with detecting PetitPotam, CVE-2021-36942. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to Domain Controllers for your environment. @@ -19929,7 +20343,7 @@ search = `wineventlog_security` EventCode=4768 Client_Address!="::1" Certificate action.escu = 0 action.escu.enabled = 1 description = This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data exfiltration. -action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003", "T1048"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data exfiltration. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled. @@ -19951,7 +20365,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Plain HTTP POST Exfiltrated Data - Rule -action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "UriPath"}, {"name": "form_data", "role": ["Attacker"], "type": "formdata"}]} +action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003", "T1048"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "UriPath"}, {"name": "form_data", "role": ["Attacker"], "type": "formdata"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data exfiltration. @@ -19973,7 +20387,7 @@ search = `stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.e action.escu = 0 action.escu.enabled = 1 description = The following Hunting analytic assists with identifying suspicious PowerShell execution using Script Block Logging, or EventCode 4104. This analytic is not meant to be ran hourly, but occasionally to identify malicious or suspicious PowerShell. This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} action.escu.data_models = [] action.escu.eli5 = The following Hunting analytic assists with identifying suspicious PowerShell execution using Script Block Logging, or EventCode 4104. This analytic is not meant to be ran hourly, but occasionally to identify malicious or suspicious PowerShell. This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team. action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -19995,7 +20409,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - PowerShell 4104 Hunting - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following Hunting analytic assists with identifying suspicious PowerShell execution using Script Block Logging, or EventCode 4104. This analytic is not meant to be ran hourly, but occasionally to identify malicious or suspicious PowerShell. This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team. @@ -20019,7 +20433,7 @@ action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059", "T1059.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \ @@ -20043,7 +20457,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - PowerShell Domain Enumeration - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 70, "context": ["source:endpoint", {"stage": "recon"}], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 70, "context": ["source:endpoint", {"stage": "recon"}], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ @@ -20067,7 +20481,7 @@ search = `powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netf action.escu = 0 action.escu.enabled = 1 description = The following hunting analytic identifies the use of `get-localgroup` being used with PowerShell to identify local groups on the endpoint. During triage, review parallel processes and identify any further suspicious behavior. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following hunting analytic identifies the use of `get-localgroup` being used with PowerShell to identify local groups on the endpoint. During triage, review parallel processes and identify any further suspicious behavior. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -20089,7 +20503,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - PowerShell Get LocalGroup Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -20114,7 +20528,7 @@ action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \ @@ -20138,7 +20552,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ @@ -20207,7 +20621,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -20229,7 +20643,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Powershell Creating Thread Mutex - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. @@ -20251,7 +20665,7 @@ search = `powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count action.escu = 0 action.escu.enabled = 1 description = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -20269,7 +20683,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Powershell Disable Security Monitoring - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -20292,7 +20706,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -20310,7 +20724,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Powershell Enable SMB1Protocol Feature - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. @@ -20332,7 +20746,7 @@ search = `powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" action.escu = 0 action.escu.enabled = 1 description = This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015", "T1546"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -20354,7 +20768,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Powershell Execute COM Object - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015", "T1546"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac. @@ -20379,7 +20793,7 @@ description = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies `GetProcAddress` in the script block. This is not normal to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack toolkits use GetProcAddress to obtain code execution. \ In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later referenced/executed elsewhere. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1059.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1055", "T1059.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ This analytic identifies `GetProcAddress` in the script block. This is not normal to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack toolkits use GetProcAddress to obtain code execution. \ @@ -20404,7 +20818,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "recon"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "recon"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1055", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ @@ -20432,7 +20846,7 @@ description = The following analytic utilizes PowerShell Script Block Logging (E This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \ Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1027", "T1059.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059", "T1027", "T1059.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \ @@ -20457,7 +20871,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1027", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059", "T1027", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ @@ -20484,7 +20898,7 @@ action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies PowerShell cmdlet - `get-localgroup` being ran. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies PowerShell cmdlet - `get-localgroup` being ran. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ @@ -20508,7 +20922,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ @@ -20532,7 +20946,7 @@ search = `powershell` EventCode=4104 Message = "*get-localgroup*" | stats count action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -20554,7 +20968,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Powershell Processing Stream Of Data - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. @@ -20705,13 +21119,58 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "bcdedit.exe" Processes.process = "*bootstatuspolicy*" Processes.process = "*ignoreallfailures*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `prevent_automatic_repair_mode_using_bcdedit_filter` +[ESCU - Print Processor Registry Autostart - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a suspicious modification or new registry entry regarding print processor. This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine. This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic is to detect a suspicious modification or new registry entry regarding print processor. This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine. This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = possible new printer installation may add driver component on this registry. +action.escu.creation_date = 2021-09-28 +action.escu.modification_date = 2021-09-28 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Print Processor Registry Autostart - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation"] +action.risk = 1 +action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Print Processor Registry Autostart - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation"], "confidence": 100, "context": ["source:endpoint", "stage:Privilege Escalation Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a suspicious modification or new registry entry regarding print processor. This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine. This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services. +action.notable.param.rule_title = Print Processor Registry Autostart +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `print_processor_registry_autostart_filter` + [ESCU - Print Spooler Adding A Printer Driver - Rule] action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ @@ -20735,7 +21194,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Print Spooler Adding A Printer Driver - Rule -action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "cve": ["CVE-2021-34527", "CVE-2021-1675"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ @@ -20762,7 +21221,7 @@ description = The following analytic identifies driver load errors utilizing the Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ The analytic is based on file path and failure to load the plug-in. \ During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ @@ -20787,7 +21246,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Print Spooler Failed to Load a Plug-in - Rule -action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "cve": ["CVE-2021-34527", "CVE-2021-1675"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ @@ -20812,7 +21271,7 @@ search = `printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909" action.escu = 0 action.escu.enabled = 1 description = This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. -action.escu.mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.002"], "nist": ["ID.AM", "PR.DS"]} +action.escu.mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566", "T1566.002"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = [] action.escu.eli5 = This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. action.escu.how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. @@ -20834,7 +21293,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Process Creating LNK file in Suspicious Location - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 7", "CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "Initial Access"}], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 7", "CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "Initial Access"}], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566", "T1566.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -20947,7 +21406,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -20969,7 +21428,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Process Kill Base On File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -20988,6 +21447,51 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` AND Processes.process="*process*" AND Processes.process="*executablepath*" AND Processes.process="*delete*" by Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_kill_base_on_file_path_filter` +[ESCU - Process Writing DynamicWrapperX - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering it into the registry is highly suspect. Why is it needed? In most malicious instances, it will be written to disk at a non-standard location. During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1559.001"]} +action.escu.data_models = [] +action.escu.eli5 = DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering it into the registry is highly suspect. Why is it needed? In most malicious instances, it will be written to disk at a non-standard location. During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default). +action.escu.creation_date = 2021-10-05 +action.escu.modification_date = 2021-10-05 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Process Writing DynamicWrapperX - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Remcos"] +action.risk = 1 +action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Process Writing DynamicWrapperX - Rule +action.correlationsearch.annotations = {"analytic_story": ["Remcos"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1559.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering it into the registry is highly suspect. Why is it needed? In most malicious instances, it will be written to disk at a non-standard location. During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. +action.notable.param.rule_title = Process Writing DynamicWrapperX +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="dynwrapx.dll" by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time) as lastTime by dest process_name process_guid file_name file_path file_create_time user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_writing_dynamicwrapperx_filter` + [ESCU - Processes Tapping Keyboard Events - Rule] action.escu = 0 action.escu.enabled = 1 @@ -21073,7 +21577,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -21095,7 +21599,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Processes launching netsh - Rule -action.correlationsearch.annotations = {"analytic_story": ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 70, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 70, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21199,7 +21703,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for network traffic on common ports where a higher layer protocol does not match the port that is being used. For example, this search should identify cases where protocols other than HTTP are running on TCP port 80. This can be used by attackers to circumvent firewall restrictions, or as an attempt to hide malicious communications over ports and protocols that are typically allowed and not well inspected. -action.escu.mappings = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["DE.AE", "PR.AC"]} +action.escu.mappings = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["DE.AE", "PR.AC"]} action.escu.data_models = ["Network_Traffic"] action.escu.eli5 = This search looks for network traffic on common ports where a higher layer protocol does not match the port that is being used. For example, this search should identify cases where protocols other than HTTP are running on TCP port 80. This can be used by attackers to circumvent firewall restrictions, or as an attempt to hide malicious communications over ports and protocols that are typically allowed and not well inspected. action.escu.how_to_implement = Running this search properly requires a technology that can inspect network traffic and identify common protocols. Technologies such as Bro and Palo Alto Networks firewalls are two examples that will identify protocols via inspection, and not just assume a specific protocol based on the transport protocol and ports. @@ -21217,7 +21721,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Protocol or Port Mismatch - Rule -action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["DE.AE", "PR.AC"]} +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["DE.AE", "PR.AC"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for network traffic on common ports where a higher layer protocol does not match the port that is being used. For example, this search should identify cases where protocols other than HTTP are running on TCP port 80. This can be used by attackers to circumvent firewall restrictions, or as an attempt to hide malicious communications over ports and protocols that are typically allowed and not well inspected. @@ -21412,7 +21916,7 @@ search = `powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiO action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004", "T1070"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -21430,7 +21934,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Recursive Delete of Directory In Batch CMD - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004", "T1070"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21453,7 +21957,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The search looks for reg.exe modifying registry keys that define Windows services and their configurations. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011", "T1574"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The search looks for reg.exe modifying registry keys that define Windows services and their configurations. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. @@ -21475,7 +21979,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 60, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation", "Defense Evasion"], "impact": 75, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 60, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation", "Defense Evasion"], "impact": 75, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011", "T1574"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21539,7 +22043,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = The search looks for modifications to registry keys that can be used to launch an application or service at system startup. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = The search looks for modifications to registry keys that can be used to launch an application or service at system startup. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. @@ -21561,7 +22065,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Registry Keys Used For Persistence - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A ", "IcedID", "Remcos"], "cis20": ["CIS 8"], "confidence": 95, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001"], "nist": ["PR.PT", "DE.CM", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A ", "IcedID", "Remcos"], "cis20": ["CIS 8"], "confidence": 95, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["PR.PT", "DE.CM", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21578,13 +22082,13 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter` +search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter` [ESCU - Registry Keys Used For Privilege Escalation - Rule] action.escu = 0 action.escu.enabled = 1 description = This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012", "T1546"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. @@ -21606,7 +22110,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Registry Keys Used For Privilege Escalation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"], "cis20": ["CIS 8"], "confidence": 95, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"], "cis20": ["CIS 8"], "confidence": 95, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012", "T1546"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21629,7 +22133,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTim action.escu = 0 action.escu.enabled = 1 description = This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. action.escu.how_to_implement = To successfully implement this search, you must populate the Change_Analysis data model. This is typically populated via endpoint detection and response product, such as Carbon Black or other endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. @@ -21651,7 +22155,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Registry Keys for Creating SHIM Databases - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21670,6 +22174,51 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB* by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_for_creating_shim_databases_filter` +[ESCU - Regsvr32 Silent Param Dll Loading - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = Other third part application may used this parameter but not so common in base windows environment. +action.escu.creation_date = 2021-10-04 +action.escu.modification_date = 2021-10-04 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Regsvr32 Silent Param Dll Loading - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Regsvr32 Activity"] +action.risk = 1 +action.risk.param._risk_message = regsvr32 process with $process$ commandline in $dest$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Regsvr32 Silent Param Dll Loading - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32. +action.notable.param.rule_title = Regsvr32 Silent Param Dll Loading +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe Processes.process="*/i*" Processes.process="*/s*" by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `regsvr32_silent_param_dll_loading_filter` + [ESCU - Remcos RAT File Creation in Remcos Folder - Rule] action.escu = 0 action.escu.enabled = 1 @@ -21715,11 +22264,56 @@ realtime_schedule = 0 is_visible = false search = |tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat") Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter` +[ESCU - Remcos client registry install entry - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search detects registry key license at host where Remcos RAT agent is installed. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} +action.escu.data_models = [] +action.escu.eli5 = This search detects registry key license at host where Remcos RAT agent is installed. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-09-24 +action.escu.modification_date = 2021-09-24 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Remcos client registry install entry - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Remcos"] +action.risk = 1 +action.risk.param._risk_message = A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Remcos client registry install entry - Rule +action.correlationsearch.annotations = {"analytic_story": ["Remcos"], "confidence": 100, "context": ["Source:Endpoint"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search detects registry key license at host where Remcos RAT agent is installed. +action.notable.param.rule_title = Remcos client registry install entry +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`remcos_client_registry_install_entry_filter` + [ESCU - Remote Desktop Network Bruteforce - Rule] action.escu = 0 action.escu.enabled = 1 description = This search looks for RDP application network traffic and filters any source/destination pair generating more than twice the standard deviation of the average traffic. -action.escu.mappings = {"cis20": ["CIS 12", "CIS 9", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Delivery"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 12", "CIS 9", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Delivery"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} action.escu.data_models = ["Network_Traffic"] action.escu.eli5 = This search looks for RDP application network traffic and filters any source/destination pair generating more than twice the standard deviation of the average traffic. action.escu.how_to_implement = You must ensure that your network traffic data is populating the Network_Traffic data model. @@ -21737,7 +22331,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Remote Desktop Network Bruteforce - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware"], "cis20": ["CIS 12", "CIS 9", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Delivery"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware"], "cis20": ["CIS 12", "CIS 9", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Delivery"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -21760,7 +22354,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for network traffic on TCP/3389, the default port used by remote desktop. While remote desktop traffic is not uncommon on a network, it is usually associated with known hosts. This search will ignore common RDP sources and common RDP destinations so you can focus on the uncommon uses of remote desktop on your network. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} action.escu.data_models = ["Network_Traffic"] action.escu.eli5 = This search looks for network traffic on TCP/3389, the default port used by remote desktop. While remote desktop traffic is not uncommon on a network, it is usually associated with known hosts. This search will ignore common RDP sources and common RDP destinations so you can focus on the uncommon uses of remote desktop on your network. action.escu.how_to_implement = To successfully implement this search you need to identify systems that commonly originate remote desktop traffic and that commonly receive remote desktop traffic. You can use the included support search "Identify Systems Creating Remote Desktop Traffic" to identify systems that originate the traffic and the search "Identify Systems Receiving Remote Desktop Traffic" to identify systems that receive a lot of remote desktop traffic. After identifying these systems, you will need to add the "common_rdp_source" or "common_rdp_destination" category to that system depending on the usage, using the Enterprise Security Assets and Identities framework. This can be done by adding an entry in the assets.csv file located in SA-IdentityManagement/lookups. @@ -21778,7 +22372,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Remote Desktop Network Traffic - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Lateral Movement"], "cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Lateral Movement"], "cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -21801,7 +22395,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for the remote desktop process mstsc.exe running on systems upon which it doesn't typically run. This is accomplished by filtering out all systems that are noted in the `common_rdp_source category` in the Assets and Identity framework. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for the remote desktop process mstsc.exe running on systems upon which it doesn't typically run. This is accomplished by filtering out all systems that are noted in the `common_rdp_source category` in the Assets and Identity framework. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. The search requires you to identify systems that do not commonly use remote desktop. You can use the included support search "Identify Systems Using Remote Desktop" to identify these systems. After identifying them, you will need to add the "common_rdp_source" category to that system using the Enterprise Security Assets and Identities framework. This can be done by adding an entry in the assets.csv file located in `SA-IdentityManagement/lookups`. @@ -21819,7 +22413,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Remote Desktop Process Running On System - Rule -action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Lateral Movement"], "cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Lateral Movement"], "cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22287,7 +22881,7 @@ search = | tstats `security_content_summariesonly` count values(Registry.registr action.escu = 0 action.escu.enabled = 1 description = This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for executing scripts with rundll32. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -22309,7 +22903,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - RunDLL Loading DLL By Ordinal - Rule -action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 8"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 8"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22332,7 +22926,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = The following hunting detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. \ This is written to be a bit more broad by not including .cpl. \ During triage, review parallel processes to identify any further suspicious behavior. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following hunting detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. \ This is written to be a bit more broad by not including .cpl. \ During triage, review parallel processes to identify any further suspicious behavior. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -22354,7 +22948,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 Control RunDLL Hunt - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22377,7 +22971,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type from windows\temp, programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. This is written to be a bit more broad by not including .cpl. The paths are specified, add more as needed. During triage, review parallel processes to identify any further suspicious behavior. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type from windows\temp, programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. This is written to be a bit more broad by not including .cpl. The paths are specified, add more as needed. During triage, review parallel processes to identify any further suspicious behavior. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -22399,7 +22993,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 Control RunDLL World Writable Directory - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22510,7 +23104,7 @@ search = `sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("* action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious rundll32.exe process having a http connection and do a dns query in some web domain. This technique was seen in IcedID malware where the rundll32 that execute its payload will contact amazon.com to check internet connect and to communicate to its C&C server to download config and other file component. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a suspicious rundll32.exe process having a http connection and do a dns query in some web domain. This technique was seen in IcedID malware where the rundll32 that execute its payload will contact amazon.com to check internet connect and to communicate to its C&C server to download config and other file component. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. @@ -22532,7 +23126,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 DNSQuery - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe process having a http connection and do a dns query in some web domain. This technique was seen in IcedID malware where the rundll32 that execute its payload will contact amazon.com to check internet connect and to communicate to its C&C server to download config and other file component. @@ -22554,7 +23148,7 @@ search = `sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_ti action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable drop it either appdata or programdata as part of its execution. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable drop it either appdata or programdata as part of its execution. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and eventcode 11 executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. @@ -22576,7 +23170,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 Process Creating Exe Dll Files - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -22595,17 +23189,62 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe", "*.dll",) | stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename ProcessGuid dest user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_process_creating_exe_dll_files_filter` +[ESCU - Rundll32 Shimcache Flush - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a suspicious rundll32 commandline to clear shim cache. This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic is to detect a suspicious rundll32 commandline to clear shim cache. This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-10-05 +action.escu.modification_date = 2021-10-05 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Rundll32 Shimcache Flush - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Unusual Processes"] +action.risk = 1 +action.risk.param._risk_message = rundll32 process execute $process$ to clear shim cache in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 80}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Rundll32 Shimcache Flush - Rule +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "confidence": 100, "context": ["Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a suspicious rundll32 commandline to clear shim cache. This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. +action.notable.param.rule_title = Rundll32 Shimcache Flush +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter` + [ESCU - Rundll32 with no Command Line Arguments with Network - Rule] action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. -action.escu.creation_date = 2021-04-19 -action.escu.modification_date = 2021-04-19 +action.escu.creation_date = 2021-10-13 +action.escu.modification_date = 2021-10-13 action.escu.confidence = high action.escu.full_search_name = ESCU - Rundll32 with no Command Line Arguments with Network - Rule action.escu.search_type = detection @@ -22621,7 +23260,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 with no Command Line Arguments with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "processname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "cve": ["CVE-2021-34527"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "processname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -22638,7 +23277,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(rundll32\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port | `rundll32_with_no_command_line_arguments_with_network_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(rundll32\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `rundll32_with_no_command_line_arguments_with_network_filter` [ESCU - Ryuk Test Files Detected - Rule] action.escu = 0 @@ -22688,7 +23327,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This is a high fidelity indicator of Ryuk ransomware executing on an endpoint. Upon triage, isolate the endpoint. Additional file modification events will be within the users profile (\appdata\roaming) and in public directories (users\public\). Review all Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged. -action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1059.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1059", "T1059.003"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This is a high fidelity indicator of Ryuk ransomware executing on an endpoint. Upon triage, isolate the endpoint. Additional file modification events will be within the users profile (\appdata\roaming) and in public directories (users\public\). Review all Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled Tasks will include a path to a unknown binary and those endpoints should be isolated until triaged. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -22710,7 +23349,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Ryuk Wake on LAN Command - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1059.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1059", "T1059.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22733,7 +23372,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords. action.escu.how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." @@ -22755,7 +23394,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - SAM Database File Access Attempt - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}, {"name": "Object_Name", "role": ["Other"], "type": "File"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "cve": ["CVE-2021-36934"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}, {"name": "Object_Name", "role": ["Other"], "type": "File"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22778,7 +23417,7 @@ search = `wineventlog_security` (EventCode=4663) process_name!=*\\dllhost.exe O action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -22800,7 +23439,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - SLUI RunAs Elevated - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22823,7 +23462,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -22845,7 +23484,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - SLUI Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22868,7 +23507,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for spikes in the number of Server Message Block (SMB) traffic connections. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002", "T1021"], "nist": ["DE.CM"]} action.escu.data_models = ["Network_Traffic"] action.escu.eli5 = This search looks for spikes in the number of Server Message Block (SMB) traffic connections. action.escu.how_to_implement = This search requires you to be ingesting your network traffic logs and populating the `Network_Traffic` data model. @@ -22886,7 +23525,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - SMB Traffic Spike - Rule -action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002", "T1021"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['src'] @@ -22909,7 +23548,7 @@ search = | tstats `security_content_summariesonly` count from datamodel=Network_ action.escu = 0 action.escu.enabled = 1 description = This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the number of Server Message Block (SMB) connections. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002", "T1021"], "nist": ["DE.CM"]} action.escu.data_models = ["Network_Traffic"] action.escu.eli5 = This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the number of Server Message Block (SMB) connections. action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of SMB Traffic - MLTK" must be executed before this detection search, because it builds a machine-learning (ML) model over the historical data used by this search. It is important that this search is run in the same app context as the associated support search, so that the model created by the support search is available for use. You should periodically re-run the support search to rebuild the model with the latest data available in your environment.\ @@ -22930,7 +23569,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - SMB Traffic Spike - MLTK - Rule -action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002", "T1021"], "nist": ["DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -23039,7 +23678,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for arguments to sc.exe indicating the creation or modification of a Windows service. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003", "T1543"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for arguments to sc.exe indicating the creation or modification of a Windows service. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -23061,7 +23700,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Sc exe Manipulating Windows Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003", "T1543"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23084,7 +23723,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = This analytic is to detect an application try to connect and create ADSI Object to do LDAP query. Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. If it has changed since the last connection, the schema is downloaded and stored in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious application like blackmatter ransomware that use ADS object api to execute ldap query. having a good list of ldap or normal AD query tool used within the network is a good start to reduce the noise. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002", "T1087"]} action.escu.data_models = [] action.escu.eli5 = This analytic is to detect an application try to connect and create ADSI Object to do LDAP query. Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. If it has changed since the last connection, the schema is downloaded and stored in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious application like blackmatter ransomware that use ADS object api to execute ldap query. having a good list of ldap or normal AD query tool used within the network is a good start to reduce the noise. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -23106,7 +23745,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - SchCache Change By App Connect And Create ADSI Object - Rule -action.correlationsearch.annotations = {"analytic_story": ["blackMatter ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["blackMatter ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic is to detect an application try to connect and create ADSI Object to do LDAP query. Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. If it has changed since the last connection, the schema is downloaded and stored in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious application like blackmatter ransomware that use ADS object api to execute ldap query. having a good list of ldap or normal AD query tool used within the network is a good start to reduce the noise. @@ -23216,7 +23855,7 @@ search = `wineventlog_security` EventCode=4698 | xmlkv Message | search Command action.escu = 0 action.escu.enabled = 1 description = This search looks for flags passed to schtasks.exe on the command-line that indicate a task was created via command like. This has been associated with the Dragonfly threat actor, and the SUNBURST attack against Solarwinds. -action.escu.mappings = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for flags passed to schtasks.exe on the command-line that indicate a task was created via command like. This has been associated with the Dragonfly threat actor, and the SUNBURST attack against Solarwinds. action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -23238,7 +23877,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Scheduled Task Deleted Or Created via CMD - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 3"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 3"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23347,7 +23986,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = This search looks for flags passed to schtasks.exe on the command-line that indicate a job is being scheduled on a remote system. -action.escu.mappings = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for flags passed to schtasks.exe on the command-line that indicate a job is being scheduled on a remote system. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -23369,7 +24008,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Schtasks scheduling job on remote system - Rule -action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement", "NOBELIUM Group"], "cis20": ["CIS 3"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement", "NOBELIUM Group"], "cis20": ["CIS 3"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23392,7 +24031,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for flags passed to schtasks.exe on the command-line that indicate that a forced reboot of system is scheduled. -action.escu.mappings = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for flags passed to schtasks.exe on the command-line that indicate that a forced reboot of system is scheduled. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -23414,7 +24053,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Schtasks used for forcing a reboot - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware"], "cis20": ["CIS 3"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware"], "cis20": ["CIS 3"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23433,6 +24072,51 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schtasks_used_for_forcing_a_reboot_filter` +[ESCU - Screensaver Event Trigger Execution - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546", "T1546.002"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-09-27 +action.escu.modification_date = 2021-09-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Screensaver Event Trigger Execution - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation"] +action.risk = 1 +action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Screensaver Event Trigger Execution - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation"], "confidence": 90, "context": ["source:endpoint", "stage:Privilege Escalation Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546", "T1546.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. +action.notable.param.rule_title = Screensaver Event Trigger Execution +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `screensaver_event_trigger_execution_filter` + [ESCU - Script Execution via WMI - Rule] action.escu = 0 action.escu.enabled = 1 @@ -23482,7 +24166,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -23504,7 +24188,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Sdclt UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -23523,6 +24207,51 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "IsolatedCommand") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter` +[ESCU - Sdelete Application Execution - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect the execution of sdelete.exe application sysinternal tools. This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user execute this application which is not a common practice. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic is to detect the execution of sdelete.exe application sysinternal tools. This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user execute this application which is not a common practice. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = user may execute and use this application +action.escu.creation_date = 2021-10-06 +action.escu.modification_date = 2021-10-06 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Sdelete Application Execution - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Masquerading - Rename System Utilities"] +action.risk = 1 +action.risk.param._risk_message = sdelete process $process_name$ executed in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Sdelete Application Execution - Rule +action.correlationsearch.annotations = {"analytic_story": ["Masquerading - Rename System Utilities"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect the execution of sdelete.exe application sysinternal tools. This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user execute this application which is not a common practice. +action.notable.param.rule_title = Sdelete Application Execution +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_sdelete` by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdelete_application_execution_filter` + [ESCU - SearchProtocolHost with no Command Line with Network - Rule] action.escu = 0 action.escu.enabled = 1 @@ -23532,8 +24261,8 @@ action.escu.data_models = [] action.escu.eli5 = The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. action.escu.known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. -action.escu.creation_date = 2021-04-19 -action.escu.modification_date = 2021-04-19 +action.escu.creation_date = 2021-10-13 +action.escu.modification_date = 2021-10-13 action.escu.confidence = high action.escu.full_search_name = ESCU - SearchProtocolHost with no Command Line with Network - Rule action.escu.search_type = detection @@ -23566,13 +24295,13 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter` [ESCU - SecretDumps Offline NTDS Dumping Tool - Rule] action.escu = 0 action.escu.enabled = 1 description = This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003", "T1003"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -23594,7 +24323,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - SecretDumps Offline NTDS Dumping Tool - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["source:endpoint", {"stage": "Credential Access"}], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["source:endpoint", {"stage": "Credential Access"}], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003", "T1003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23662,7 +24391,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = Monitor for changes of the ExecutionPolicy in the registry to the values "unrestricted" or "bypass," which allows the execution of malicious scripts. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Monitor for changes of the ExecutionPolicy in the registry to the values "unrestricted" or "bypass," which allows the execution of malicious scripts. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Registry node. You must also be ingesting logs with the fields registry_path, registry_key_name, and registry_value_name from your endpoints. @@ -23684,7 +24413,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "registry_path", "role": ["Others"], "type": "RegistryPath"}]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "registry_path", "role": ["Others"], "type": "RegistryPath"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -23707,7 +24436,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. action.escu.how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. @@ -23729,7 +24458,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Shim Database File Creation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Others"], "type": "file path"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Others"], "type": "file path"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -23752,7 +24481,7 @@ search = | tstats `security_content_summariesonly` count values(Filesystem.actio action.escu = 0 action.escu.enabled = 1 description = This search detects the process execution and arguments required to silently create a shim database. The sdbinst.exe application is used to install shim database files (.sdb). A shim is a small library which transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search detects the process execution and arguments required to silently create a shim database. The sdbinst.exe application is used to install shim database files (.sdb). A shim is a small library which transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -23774,7 +24503,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Shim Database Installation With Suspicious Parameters - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23797,7 +24526,7 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as action.escu = 0 action.escu.enabled = 1 description = This search detects accounts that were created and deleted in a short time period. -action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1136.001"], "nist": ["PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.IP"]} action.escu.data_models = ["Change"] action.escu.eli5 = This search detects accounts that were created and deleted in a short time period. action.escu.how_to_implement = This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs. More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/ @@ -23819,7 +24548,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Short Lived Windows Accounts - Rule -action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 90, "context": ["source:endpoint", {"stage": "Persistence"}], "impact": 70, "mitre_attack": ["T1136.001"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 90, "context": ["source:endpoint", {"stage": "Persistence"}], "impact": 70, "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23842,7 +24571,7 @@ search = | tstats `security_content_summariesonly` values(All_Changes.result_id) action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -23864,7 +24593,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - SilentCleanup UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -23887,7 +24616,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for process names that consist only of a single letter. -action.escu.mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]} +action.escu.mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204", "T1204.002"], "nist": ["ID.AM", "PR.DS"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for process names that consist only of a single letter. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -23909,7 +24638,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Single Letter Process On Endpoint - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 2"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 2"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204", "T1204.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for process names that consist only of a single letter. @@ -23949,7 +24678,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Deprecated - Spectre and Meltdown Vulnerable Systems - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spectre And Meltdown Vulnerabilities"], "cis20": ["CIS 4"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Spectre And Meltdown Vulnerabilities"], "cis20": ["CIS 4"], "cve": ["CVE-2017-5753"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24031,7 +24760,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Deprecated - Splunk Enterprise Information Disclosure - Rule -action.correlationsearch.annotations = {"analytic_story": ["Splunk Enterprise Vulnerability CVE-2018-11409"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Splunk Enterprise Vulnerability CVE-2018-11409"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "cve": ["CVE-2018-11409"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -24054,7 +24783,7 @@ search = index=_internal sourcetype=splunkd_ui_access server-info | search clien action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -24076,7 +24805,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Spoolsv Spawning Rundll32 - Rule -action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -24099,7 +24828,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -24121,7 +24850,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Spoolsv Suspicious Loaded Modules - Rule -action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "ImageLoaded", "role": ["Other"], "type": "File"}]} +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "ImageLoaded", "role": ["Other"], "type": "File"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. @@ -24165,7 +24894,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Spoolsv Suspicious Process Access - Rule -action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ProcessID", "role": ["Parent Process"], "type": "Process"}, {"name": "TargetImage", "role": ["Target"], "type": "Process Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ProcessID", "role": ["Parent Process"], "type": "Process"}, {"name": "TargetImage", "role": ["Target"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack. @@ -24187,7 +24916,7 @@ search = `sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Wi action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. @@ -24209,7 +24938,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Spoolsv Writing a DLL - Rule -action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion"], "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24232,7 +24961,7 @@ search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. @@ -24254,7 +24983,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Spoolsv Writing a DLL - Sysmon - Rule -action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} +action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. @@ -24320,7 +25049,7 @@ search = `sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFile action.escu = 0 action.escu.enabled = 1 description = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. @@ -24342,7 +25071,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Start Up During Safe Mode Boot - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24484,6 +25213,51 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name!=Explorer.exe AND Processes.process_name!=OpenWith.exe by Processes.process_id Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join [| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count from datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table process_id dest registry_path]| `suspicious_changes_to_file_associations_filter` +[ESCU - Suspicious Copy on System32 - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036.003", "T1036"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = every user may do this event but very un-ussual. +action.escu.creation_date = 2021-10-05 +action.escu.modification_date = 2021-10-05 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Suspicious Copy on System32 - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Unusual Processes"] +action.risk = 1 +action.risk.param._risk_message = execution of copy exe to copy file from $process$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Suspicious Copy on System32 - Rule +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "confidence": 90, "context": ["Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036.003", "T1036"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. +action.notable.param.rule_title = Suspicious Copy on System32 +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `suspicious_copy_on_system32_filter` + [ESCU - Suspicious Curl Network Connection - Rule] action.escu = 0 action.escu.enabled = 1 @@ -24574,7 +25348,7 @@ search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint action.escu = 0 action.escu.enabled = 1 description = This analytic will detect suspicious driver loaded paths. This technique is commonly used by malicious software like coin miners (xmrig) to register its malicious driver from notable directories where executable or drivers do not commonly exist. During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003", "T1543"]} action.escu.data_models = [] action.escu.eli5 = This analytic will detect suspicious driver loaded paths. This technique is commonly used by malicious software like coin miners (xmrig) to register its malicious driver from notable directories where executable or drivers do not commonly exist. During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -24596,7 +25370,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Driver Loaded Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "File Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003", "T1543"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic will detect suspicious driver loaded paths. This technique is commonly used by malicious software like coin miners (xmrig) to register its malicious driver from notable directories where executable or drivers do not commonly exist. During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review. @@ -24659,7 +25433,7 @@ search = |tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for emails that have attachments with suspicious file extensions. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001"], "nist": ["DE.AE", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566"], "nist": ["DE.AE", "PR.IP"]} action.escu.data_models = ["Email"] action.escu.eli5 = This search looks for emails that have attachments with suspicious file extensions. action.escu.how_to_implement = You need to ingest data from emails. Specifically, the sender's address and the file names of any attachments must be mapped to the Email data model. \ @@ -24679,7 +25453,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Email Attachment Extensions - Rule -action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"], "cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001"], "nist": ["DE.AE", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"], "cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566"], "nist": ["DE.AE", "PR.IP"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for emails that have attachments with suspicious file extensions. @@ -24701,7 +25475,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes Windows Event ID 1100 to identify when Windows event log service is shutdown. Note that this is a voluminous analytic that will require tuning or restricted to specific endpoints based on criticality. This event generates every time Windows Event Log service has shut down. It also generates during normal system shutdown. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes Windows Event ID 1100 to identify when Windows event log service is shutdown. Note that this is a voluminous analytic that will require tuning or restricted to specific endpoints based on criticality. This event generates every time Windows Event Log service has shut down. It also generates during normal system shutdown. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. @@ -24723,7 +25497,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Event Log Service Behavior - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24832,7 +25606,7 @@ search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint action.escu = 0 action.escu.enabled = 1 description = this search is to detect a suspicious regsvr32 commandline "-s" to execute a dll files. This technique was seen in IcedID malware to execute its initial downloader dll that will download the 2nd stage loader that will download and decrypt the config payload. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.010"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is to detect a suspicious regsvr32 commandline "-s" to execute a dll files. This technique was seen in IcedID malware to execute its initial downloader dll that will download the 2nd stage loader that will download and decrypt the config payload. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -24854,7 +25628,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious IcedID Regsvr32 Cmdline - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.010"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -24877,7 +25651,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious rundll32.exe commandline to execute dll file. This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted dll payload which is the license.dat. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious rundll32.exe commandline to execute dll file. This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted dll payload which is the license.dat. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -24899,7 +25673,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious IcedID Rundll32 Cmdline - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25008,7 +25782,7 @@ search = `stream_http` http_method=POST http_content_length>1 | regex form_data= action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies renamed instances of msbuild.exe executing. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the code executed and what is executing a renamed instance of MSBuild. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies renamed instances of msbuild.exe executing. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the code executed and what is executing a renamed instance of MSBuild. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -25030,7 +25804,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious MSBuild Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25053,7 +25827,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In this instance, there will be command line arguments and file paths. In a malicious instance, MSBuild.exe will spawn from non-standard processes and have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should be investigated. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1127.001"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using Visual Studio. In this instance, there will be command line arguments and file paths. In a malicious instance, MSBuild.exe will spawn from non-standard processes and have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should be investigated. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -25075,7 +25849,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious MSBuild Spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25105,7 +25879,7 @@ description = The following analytic identifies the use of a native MacOS utilit - PlistBuddy -c "Add :ProgramArguments:0 string /bin/sh" ~/Library/Launchagents/init_verx.plist \ - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \ Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further. -action.escu.mappings = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001"]} +action.escu.mappings = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001", "T1543"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow, the following commands were executed:\ - PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist \ @@ -25130,7 +25904,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious PlistBuddy Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Silver Sparrow"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Silver Sparrow"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001", "T1543"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25167,7 +25941,7 @@ description = The following analytic identifies the use of a native MacOS utilit - PlistBuddy -c "Add :ProgramArguments:0 string /bin/sh" ~/Library/Launchagents/init_verx.plist \ - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \ Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further. -action.escu.mappings = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001"]} +action.escu.mappings = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001", "T1543"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow, the following commands were executed:\ - PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist \ @@ -25192,7 +25966,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious PlistBuddy Usage via OSquery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Silver Sparrow"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Silver Sparrow"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001", "T1543"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow, the following commands were executed:\ @@ -25311,7 +26085,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using non-standard file extensions to load malciious DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review additional parrallel processes and child processes for additional activity. -action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using non-standard file extensions to load malciious DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review additional parrallel processes and child processes for additional activity. action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Tune the query by filtering additional extensions found to be used by legitimate processes. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -25333,7 +26107,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Iceid"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Iceid"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25356,7 +26130,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -25378,7 +26152,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 PluginInit - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25401,7 +26175,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe executing and what script content it is loading. This query relies on the original filename or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1036", "T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe executing and what script content it is loading. This query relies on the original filename or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -25423,7 +26197,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1036", "T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25446,7 +26220,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of Cobalt Strike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. Typically, the DLL will be written and loaded from a world writeable path or user location. In most instances it will not have a valid certificate (Unsigned). During investigation, review the parent process and other parallel application execution. Capture and triage the DLL in question. In the instance of Cobalt Strike, rundll32.exe is the default process it opens and injects shellcode into. This default process can be changed, but typically is not. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -25468,7 +26242,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 StartW - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25491,7 +26265,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer method entry point in the DLL is invoked. This is typically seen when a DLL is being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it. During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer method entry point in the DLL is invoked. This is typically seen when a DLL is being registered on the system. Not every instance is considered malicious, but it will capture malicious use of it. During investigation, review the parent process and parrellel processes executing. Capture the DLL being loaded and inspect further. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -25513,7 +26287,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 dllregisterserver - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25536,7 +26310,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -25558,7 +26332,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "cve": ["CVE-2021-34527"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -25622,7 +26396,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following detection identifies Scheduled Tasks registering (creating a new task) a binary or script to run from a public directory which includes users\public, \programdata\ and \windows\temp. Upon triage, review the binary or script in the command line for legitimacy, whether an approved binary/script or not. In addition, capture the binary or script in question and analyze for further behaviors. Identify the source and contain the endpoint. -action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1053.005"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1053.005", "T1053"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies Scheduled Tasks registering (creating a new task) a binary or script to run from a public directory which includes users\public, \programdata\ and \windows\temp. Upon triage, review the binary or script in the command line for legitimacy, whether an approved binary/script or not. In addition, capture the binary or script in question and analyze for further behaviors. Identify the source and contain the endpoint. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -25644,7 +26418,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Scheduled Task from Public Directory - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25757,7 +26531,7 @@ search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe. Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. A spawned child process from microsoft.workflow.compiler.exe is uncommon. In any instance, microsoft.workflow.compiler.exe spawning from an Office product or any living off the land binary is highly suspect. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe. Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. A spawned child process from microsoft.workflow.compiler.exe is uncommon. In any instance, microsoft.workflow.compiler.exe spawning from an Office product or any living off the land binary is highly suspect. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -25779,7 +26553,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25847,7 +26621,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies msbuild.exe executing from a non-standard path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio will run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however there are instances of build applications that will move or use a copy of MSBuild. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies msbuild.exe executing from a non-standard path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio will run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however there are instances of build applications that will move or use a copy of MSBuild. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -25869,7 +26643,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious msbuild path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25892,7 +26666,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies child processes spawning from "mshta.exe". The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process "mshta.exe" and its child process. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies child processes spawning from "mshta.exe". The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process "mshta.exe" and its child process. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -25914,7 +26688,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious mshta child process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Process Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25937,7 +26711,7 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn mshta.exe from svchost.exe. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn mshta.exe from svchost.exe. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -25959,7 +26733,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious mshta spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25981,14 +26755,14 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces [ESCU - Suspicious wevtutil Usage - Rule] action.escu = 0 action.escu.enabled = 1 -description = The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, or system event logs. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"]} +description = The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, trace or system event logs. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001", "T1070"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, or system event logs. +action.escu.eli5 = The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, trace or system event logs. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. action.escu.known_false_positives = The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. -action.escu.creation_date = 2020-07-22 -action.escu.modification_date = 2020-07-22 +action.escu.creation_date = 2021-10-11 +action.escu.modification_date = 2021-10-11 action.escu.confidence = high action.escu.full_search_name = ESCU - Suspicious wevtutil Usage - Rule action.escu.search_type = detection @@ -26004,11 +26778,11 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious wevtutil Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001", "T1070"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, or system event logs. +action.notable.param.rule_description = The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, trace or system event logs. action.notable.param.rule_title = Suspicious wevtutil Usage action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -26021,7 +26795,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = wevtutil.exe Processes.process="*cl*" (Processes.process="*System*" OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter` +search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") (Processes.process="*System*" OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*" OR Processes.process="*trace*") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter` [ESCU - Suspicious writes to System Volume Information - Rule] action.escu = 0 @@ -26159,7 +26933,7 @@ action.escu.enabled = 1 description = This search looks for system processes that typically execute from `C:\Windows\System32\` or `C:\Windows\SysWOW64`. This may indicate a malicious process that is trying to hide as a legitimate process.\ This detection utilizes a lookup that is deduped `system32` and `syswow64` directories from Server 2016 and Windows 10.\ During triage, review the parallel processes - what process moved the native Windows binary? identify any artifacts on disk and review. If a remote destination is contacted, what is the reputation? -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search looks for system processes that typically execute from `C:\Windows\System32\` or `C:\Windows\SysWOW64`. This may indicate a malicious process that is trying to hide as a legitimate process.\ This detection utilizes a lookup that is deduped `system32` and `syswow64` directories from Server 2016 and Windows 10.\ @@ -26183,7 +26957,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - System Processes Run From Unexpected Locations - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26298,7 +27072,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search looks for network traffic identified as The Onion Router (TOR), a benign anonymity network which can be abused for a variety of nefarious purposes. -action.escu.mappings = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.001"], "nist": ["DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071", "T1071.001"], "nist": ["DE.AE"]} action.escu.data_models = ["Network_Traffic"] action.escu.eli5 = This search looks for network traffic identified as The Onion Router (TOR), a benign anonymity network which can be abused for a variety of nefarious purposes. action.escu.how_to_implement = In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated. @@ -26316,7 +27090,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - TOR Traffic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control", "NOBELIUM Group"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.001"], "nist": ["DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control", "NOBELIUM Group"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071", "T1071.001"], "nist": ["DE.AE"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for network traffic identified as The Onion Router (TOR), a benign anonymity network which can be abused for a variety of nefarious purposes. @@ -26334,6 +27108,51 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `tor_traffic_filter` +[ESCU - Time Provider Persistence Registry - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.003", "T1547"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-09-29 +action.escu.modification_date = 2021-09-29 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Time Provider Persistence Registry - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation"] +action.risk = 1 +action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Time Provider Persistence Registry - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Windows Privilege Escalation"], "confidence": 100, "context": ["source:endpoint", "stage:Privilege Escalation Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.003", "T1547"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. +action.notable.param.rule_title = Time Provider Persistence Registry +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `time_provider_persistence_registry_filter` + [ESCU - Trickbot Named Pipe - Rule] action.escu = 0 action.escu.enabled = 1 @@ -26382,7 +27201,7 @@ search = `sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -26404,7 +27223,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - UAC Bypass MMC Load Unsigned Dll - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path @@ -26426,7 +27245,7 @@ search = `sysmon` EventCode=7 ImageLoaded = "*.dll" Image = "*\\mmc.exe" Signed action.escu = 0 action.escu.enabled = 1 description = This search is to detect a possible uac bypass using the colorui.dll COM Object. this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll COM CLSID to bypass UAC. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect a possible uac bypass using the colorui.dll COM Object. this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll COM CLSID to bypass UAC. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -26448,7 +27267,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - UAC Bypass With Colorui COM Object - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Other"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a possible uac bypass using the colorui.dll COM Object. this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll COM CLSID to bypass UAC. @@ -26578,7 +27397,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unified Messaging Service Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "cve": ["CVE-2021-26857"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26601,7 +27420,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious un-installation of application using msiexec. This technique was seen in conti leak tool and script where it tries to uninstall AV product using this commandline. This commandline to uninstall product is not a common practice in enterprise network. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007", "T1218"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious un-installation of application using msiexec. This technique was seen in conti leak tool and script where it tries to uninstall AV product using this commandline. This commandline to uninstall product is not a common practice in enterprise network. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -26623,7 +27442,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Uninstall App Using MsiExec - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007", "T1218"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26646,7 +27465,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, update this macro to filter out false positives. @@ -26668,7 +27487,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unload Sysmon Filter Driver - Rule -action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -27033,11 +27852,101 @@ realtime_schedule = 0 is_visible = false search = `powershell` EventCode=4104 (Message = "*$env:UserName*" OR Message = "*[System.Environment]::UserName*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `user_discovery_with_env_vars_powershell_script_block_filter` +[ESCU - Vbscript Execution Using Wscript App - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a suspicious wscript commandline to execute vbscript. This technique was seen in several malware to execute malicious vbs file using wscript application. commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or even some av script emulation system. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005", "T1059"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic is to detect a suspicious wscript commandline to execute vbscript. This technique was seen in several malware to execute malicious vbs file using wscript application. commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or even some av script emulation system. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-10-01 +action.escu.modification_date = 2021-10-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Vbscript Execution Using Wscript App - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["FIN7", "Remcos"] +action.risk = 1 +action.risk.param._risk_message = Process name $process_name$ with commandline $process$ to execute vbsscript +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Vbscript Execution Using Wscript App - Rule +action.correlationsearch.annotations = {"analytic_story": ["FIN7", "Remcos"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005", "T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a suspicious wscript commandline to execute vbscript. This technique was seen in several malware to execute malicious vbs file using wscript application. commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or even some av script emulation system. +action.notable.param.rule_title = Vbscript Execution Using Wscript App +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "wscript.exe" AND Processes.parent_process = "*//e:vbscript*") OR (Processes.process_name = "wscript.exe" AND Processes.process = "*//e:vbscript*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter` + +[ESCU - Verclsid CLSID Execution - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.012", "T1218"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = windows can used this application for its normal COM object validation. +action.escu.creation_date = 2021-09-29 +action.escu.modification_date = 2021-09-29 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Verclsid CLSID Execution - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Unusual Processes"] +action.risk = 1 +action.risk.param._risk_message = process $process_name$ to execute possible clsid commandline $process$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Verclsid CLSID Execution - Rule +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "confidence": 50, "context": ["source:endpoint", "stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.012", "T1218"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not. +action.notable.param.rule_title = Verclsid CLSID Execution +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_verclsid` AND Processes.process="*/S*" Processes.process="*/C*" AND Processes.process="*{*" AND Processes.process="*}*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `verclsid_clsid_execution_filter` + [ESCU - W3WP Spawning Shell - Rule] action.escu = 0 action.escu.enabled = 1 description = This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, on publicly available Exchange mail servers. During triage, review the parent process and child process of the shell being spawned. Review the command-line arguments and any file modifications that may occur. Identify additional parallel process, child processes, that may highlight further commands executed. After triaging, work to contain the threat and patch the system that is vulnerable. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, on publicly available Exchange mail servers. During triage, review the parent process and child process of the shell being spawned. Review the command-line arguments and any file modifications that may occur. Identify additional parallel process, child processes, that may highlight further commands executed. After triaging, work to contain the threat and patch the system that is vulnerable. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -27059,7 +27968,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - W3WP Spawning Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "cve": ["CVE-2021-34473", "CVE-2021-34523", "CVE-2021-31207"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -27173,7 +28082,7 @@ All event subscriptions have three components \ 1. Consumer - An action to take upon triggering the filter. EventID = 20 \ 1. Binding - Registers a filter to a consumer. EventID = 21 \ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003", "T1546"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} action.escu.data_models = [] action.escu.eli5 = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ All event subscriptions have three components \ @@ -27200,7 +28109,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WMI Permanent Event Subscription - Sysmon - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "host", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003", "T1546"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "host", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -27312,7 +28221,7 @@ search = `wmi` EventCode=5860 Temporary | rex field=Message "NotificationQuery = action.escu = 0 action.escu.enabled = 1 description = This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. @@ -27334,7 +28243,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WSReset UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -27357,7 +28266,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"]} action.escu.data_models = [] action.escu.eli5 = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -27379,7 +28288,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wbemprox COM Object Execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, @@ -27564,7 +28473,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590", "T1590.005"]} action.escu.data_models = [] action.escu.eli5 = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. @@ -27586,7 +28495,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wermgr Process Connecting To IP Check Web Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590", "T1590.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. @@ -27702,7 +28611,7 @@ The search will return the first time and last time the task was registered, as schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via TaskService. Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source. -action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"]} +action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005", "T1053"]} action.escu.data_models = [] action.escu.eli5 = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed from a user writeable file path.\ The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ @@ -27728,7 +28637,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WinEvent Scheduled Task Created Within Public Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Command"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Command"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed from a user writeable file path.\ @@ -27758,7 +28667,7 @@ The search will return the first time and last time the task was registered, as schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source. -action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"]} +action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005", "T1053"]} action.escu.data_models = [] action.escu.eli5 = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a native Windows shell (PowerShell, Cmd, Wscript, Cscript).\ The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ @@ -27784,7 +28693,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Command"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Command"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a native Windows shell (PowerShell, Cmd, Wscript, Cscript).\ @@ -27828,7 +28737,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WinRM Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "kill_chain_phases": ["Exploitation", "Privilege Escalation", "Denial of Service"], "mitre_attack": ["T1190"]} +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cve": ["CVE-2021-31166"], "kill_chain_phases": ["Exploitation", "Privilege Escalation", "Denial of Service"], "mitre_attack": ["T1190"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -27892,7 +28801,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTim action.escu = 0 action.escu.enabled = 1 description = The search looks for the Registry Key DisableAntiSpyware set to disable. This is consistent with Ryuk infections across a fleet of endpoints. This particular behavior is typically executed when an ransomware actor gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The search looks for the Registry Key DisableAntiSpyware set to disable. This is consistent with Ryuk infections across a fleet of endpoints. This particular behavior is typically executed when an ransomware actor gains access to an endpoint and beings to perform execution. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -27914,7 +28823,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows DisableAntiSpyware Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -27937,7 +28846,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes Windows Security Event ID 1102 or System log event 104 to identify when a Windows event log is cleared. Note that this analytic will require tuning or restricted to specific endpoints based on criticality. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]} action.escu.data_models = [] action.escu.eli5 = The following analytic utilizes Windows Security Event ID 1102 or System log event 104 to identify when a Windows event log is cleared. Note that this analytic will require tuning or restricted to specific endpoints based on criticality. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. @@ -27959,7 +28868,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows Event Log Cleared - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -28104,11 +29013,56 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.file_path Filesystem.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | search Filesystem.file_name=hosts AND Filesystem.file_path=*Windows\\System32\\* | `drop_dm_object_name(Filesystem)` | `windows_hosts_file_modification_filter` +[ESCU - Winhlp32 Spawning a Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the ".hlp" file name extension. This particular instance is related to a Remcos sample where dynwrapx.dll is added to the registry under inprocserver32, and later module loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During triage, review parallel processes to identify further suspicious behavior. Review module loads for unsuspecting unsigned modules. Capture any file modifications and analyze. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the ".hlp" file name extension. This particular instance is related to a Remcos sample where dynwrapx.dll is added to the registry under inprocserver32, and later module loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During triage, review parallel processes to identify further suspicious behavior. Review module loads for unsuspecting unsigned modules. Capture any file modifications and analyze. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives should be limited as winhlp32.exe is typically not used with the latest flavors of Windows OS. However, filter as needed. +action.escu.creation_date = 2021-10-05 +action.escu.modification_date = 2021-10-05 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Winhlp32 Spawning a Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Remcos"] +action.risk = 1 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, and is not typical activity for this process. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Winhlp32 Spawning a Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["Remcos"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the ".hlp" file name extension. This particular instance is related to a Remcos sample where dynwrapx.dll is added to the registry under inprocserver32, and later module loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During triage, review parallel processes to identify further suspicious behavior. Review module loads for unsuspecting unsigned modules. Capture any file modifications and analyze. +action.notable.param.rule_title = Winhlp32 Spawning a Process +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winhlp32.exe Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winhlp32_spawning_a_process_filter` + [ESCU - Winword Spawning Cmd - Rule] action.escu = 0 action.escu.enabled = 1 description = The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). Cmd.exe spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line will indicate what is being executed. During triage, review parallel processes and identify any files that may have been written. It is possible that COM is utilized to trampoline the child process to `explorer.exe` or `wmiprvse.exe`. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). Cmd.exe spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line will indicate what is being executed. During triage, review parallel processes and identify any files that may have been written. It is possible that COM is utilized to trampoline the child process to `explorer.exe` or `wmiprvse.exe`. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -28130,7 +29084,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Winword Spawning Cmd - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -28153,7 +29107,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. @@ -28175,7 +29129,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Winword Spawning PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -28198,7 +29152,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following detection identifies Microsoft Winword.exe spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64\`. `cscript.exe` or `wscript.exe` spawning from Winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line executed will most likely be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies Microsoft Winword.exe spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe` or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64\`. `cscript.exe` or `wscript.exe` spawning from Winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command-line executed will most likely be obfuscated and captured via another detection. During triage, review parallel processes and identify any files that may have been written. Review the reputation of the remote destination and block accordingly. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -28220,7 +29174,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Winword Spawning Windows Script Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachment"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachment"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -28245,7 +29199,7 @@ action.escu.enabled = 1 description = The following hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ During triage, review parallel processes and identify any further suspicious behavior. -action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"]} +action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \ @@ -28269,7 +29223,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wmic Group Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -28294,7 +29248,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. This detection catch the access event (FILE WRITE) access to a share. -action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021.002"]} +action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021", "T1021.002"]} action.escu.data_models = [] action.escu.eli5 = This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. This detection catch the access event (FILE WRITE) access to a share. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. @@ -28316,7 +29270,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Write Executable in SMB Share - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021", "T1021.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -28335,11 +29289,56 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `write_executable_in_smb_share_filter` +[ESCU - Wscript Or Cscript Suspicious Child Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic is to detect a suspicious spawned process by wscript or cscript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other script like powershell or create a suspended process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1543", "T1134.004", "T1134"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic is to detect a suspicious spawned process by wscript or cscript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other script like powershell or create a suspended process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = user may create vbs or js script that use several tool as part of its execution. +action.escu.creation_date = 2021-10-06 +action.escu.modification_date = 2021-10-06 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Wscript Or Cscript Suspicious Child Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["FIN7", "Remcos", "Unusual Processes"] +action.risk = 1 +action.risk.param._risk_message = wscript or cscript parent process spawned $process_name$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Wscript Or Cscript Suspicious Child Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["FIN7", "Remcos", "Unusual Processes"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1543", "T1134.004", "T1134"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic is to detect a suspicious spawned process by wscript or cscript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other script like powershell or create a suspended process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. +action.notable.param.rule_title = Wscript Or Cscript Suspicious Child Process +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("cscript.exe", "wscript.exe") Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wscript_or_cscript_suspicious_child_process_filter` + [ESCU - XMRIG Driver Loaded - Rule] action.escu = 0 action.escu.enabled = 1 description = This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"]} +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003", "T1543"]} action.escu.data_models = [] action.escu.eli5 = This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -28361,7 +29360,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - XMRIG Driver Loaded - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "ImageLoaded"}]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003", "T1543"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "ImageLoaded"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin. @@ -31053,76 +32052,4 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime -### END ESCU RESPONSE TASKS ### - -### USAGE DASHBOARD CONFIGURATIONS ### - -[escu-metrics-usage] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -dispatchAs = user -search = index=_audit sourcetype="audittrail" \ -"ESCU - "\ -| stats count(search) by search savedsearch_name user\ -| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \ -| rex field=search "\"(?.*)\""\ -| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=* - -[escu-metrics-search] -action.email.useNSSubject = 1 -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -enableSched = 1 -cron_schedule = 0 0 * * * -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count) - -[escu-metrics-search-events] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -cron_schedule = 0 0 * * * -enableSched = 1 -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?.*)\"" | rex field=_raw "user=(?[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y") - -[escu-metrics-search-longest-runtime] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -enableSched = 1 -cron_schedule = 0 0 * * * -disabled = 1 -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id - -[escu-metrics-usage-search] -action.email.useNSSubject = 1 -alert.digest_mode = True -alert.suppress = 0 -alert.track = 0 -auto_summarize.dispatch.earliest_time = -1d@h -cron_schedule = 0 0 * * * -dispatch.earliest_time = -4h@h -dispatch.latest_time = -1h@h -enableSched = 1 -dispatchAs = user -search = index=_audit sourcetype="audittrail" \ -"ESCU - "\ -| stats count(search) by search savedsearch_name user\ -| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \ -| rex field=search "\"(?.*)\""\ -| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=* - -### END OF USAGE DASHBOARD CONFIGURATIONS ### +### END ESCU RESPONSE TASKS ### \ No newline at end of file diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 3d368234c8..dc7f8c97e5 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-09-30T19:01:47 UTC +# On Date: 2021-10-26T01:24:23 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/lookups/mitre_enrichment.csv b/dist/escu/lookups/mitre_enrichment.csv index fee94d3941..f55f4842a3 100644 --- a/dist/escu/lookups/mitre_enrichment.csv +++ b/dist/escu/lookups/mitre_enrichment.csv @@ -1,19 +1,34 @@ "mitre_id","technique","tactics","groups" +"T1564.009","Resource Forking","Defense Evasion","no" +"T1562.010","Downgrade Attack","Defense Evasion","no" +"T1547.015","Login Items","Persistence|Privilege Escalation","no" +"T1620","Reflective Code Loading","Defense Evasion","no" +"T1619","Cloud Storage Object Discovery","Discovery","no" +"T1218.014","MMC","Defense Evasion","no" +"T1218.013","Mavinject","Defense Evasion","no" +"T1614.001","System Language Discovery","Discovery","no" +"T1615","Group Policy Discovery","Discovery","Turla" +"T1036.007","Double File Extension","Defense Evasion","Mustang Panda" +"T1562.009","Safe Mode Boot","Defense Evasion","no" +"T1564.008","Email Hiding Rules","Defense Evasion","FIN4" +"T1505.004","IIS Components","Persistence","no" +"T1027.006","HTML Smuggling","Defense Evasion","no" +"T1213.003","Code Repositories","Collection","APT29" "T1553.006","Code Signing Policy Modification","Defense Evasion","Turla|APT39" "T1614","System Location Discovery","Discovery","no" -"T1613","Container and Resource Discovery","Discovery","no" +"T1613","Container and Resource Discovery","Discovery","TeamTNT" "T1552.007","Container API","Credential Access","no" "T1612","Build Image on Host","Defense Evasion","no" -"T1611","Escape to Host","Privilege Escalation","no" -"T1204.003","Malicious Image","Execution","no" +"T1611","Escape to Host","Privilege Escalation","TeamTNT" +"T1204.003","Malicious Image","Execution","TeamTNT" "T1053.007","Container Orchestration Job","Execution|Persistence|Privilege Escalation","no" -"T1610","Deploy Container","Defense Evasion|Execution","no" -"T1609","Container Administration Command","Execution","no" +"T1610","Deploy Container","Defense Evasion|Execution","TeamTNT" +"T1609","Container Administration Command","Execution","TeamTNT" "T1608.005","Link Target","Resource Development","Silent Librarian" -"T1608.004","Drive-by Target","Resource Development","APT32|Threat Group-3390" +"T1608.004","Drive-by Target","Resource Development","Transparent Tribe|APT32|Threat Group-3390" "T1608.003","Install Digital Certificate","Resource Development","no" "T1608.002","Upload Tool","Resource Development","Threat Group-3390" -"T1608.001","Upload Malware","Resource Development","APT32" +"T1608.001","Upload Malware","Resource Development","TeamTNT|APT32" "T1608","Stage Capabilities","Resource Development","no" "T1016.001","Internet Connection Discovery","Discovery","APT29|UNC2452|Turla" "T1553.005","Mark-of-the-Web Bypass","Defense Evasion","TA505" @@ -46,7 +61,7 @@ "T1053.006","Systemd Timers","Execution|Persistence|Privilege Escalation","no" "T1562.008","Disable Cloud Logs","Defense Evasion","no" "T1547.012","Print Processors","Persistence|Privilege Escalation","no" -"T1598.003","Spearphishing Link","Reconnaissance","Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky" +"T1598.003","Spearphishing Link","Reconnaissance","Magic Hound|Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky" "T1598.002","Spearphishing Attachment","Reconnaissance","Sidewinder" "T1598.001","Spearphishing Service","Reconnaissance","no" "T1598","Phishing for Information","Reconnaissance","ZIRCONIUM|APT28" @@ -59,16 +74,16 @@ "T1596.001","DNS/Passive DNS","Reconnaissance","no" "T1596.002","WHOIS","Reconnaissance","no" "T1596","Search Open Technical Databases","Reconnaissance","no" -"T1595.002","Vulnerability Scanning","Reconnaissance","Volatile Cedar|APT28|Sandworm Team" -"T1595.001","Scanning IP Blocks","Reconnaissance","no" +"T1595.002","Vulnerability Scanning","Reconnaissance","TeamTNT|APT29|Volatile Cedar|APT28|Sandworm Team" +"T1595.001","Scanning IP Blocks","Reconnaissance","TeamTNT" "T1595","Active Scanning","Reconnaissance","no" "T1594","Search Victim-Owned Websites","Reconnaissance","Silent Librarian|Sandworm Team" "T1593.002","Search Engines","Reconnaissance","no" -"T1593.001","Social Media","Reconnaissance","no" +"T1593.001","Social Media","Reconnaissance","Kimsuky" "T1593","Search Open Websites/Domains","Reconnaissance","Sandworm Team" "T1592.004","Client Configurations","Reconnaissance","HAFNIUM" "T1592.003","Firmware","Reconnaissance","no" -"T1592.002","Software","Reconnaissance","Sandworm Team" +"T1592.002","Software","Reconnaissance","Andariel|Sandworm Team" "T1592.001","Hardware","Reconnaissance","no" "T1592","Gather Victim Host Information","Reconnaissance","no" "T1591.004","Identify Roles","Reconnaissance","no" @@ -77,46 +92,46 @@ "T1591.002","Business Relationships","Reconnaissance","Sandworm Team" "T1591","Gather Victim Org Information","Reconnaissance","no" "T1590.006","Network Security Appliances","Reconnaissance","no" -"T1590.005","IP Addresses","Reconnaissance","HAFNIUM" +"T1590.005","IP Addresses","Reconnaissance","Andariel|HAFNIUM" "T1590.004","Network Topology","Reconnaissance","no" "T1590.003","Network Trust Dependencies","Reconnaissance","no" "T1590.002","DNS","Reconnaissance","no" "T1590.001","Domain Properties","Reconnaissance","Sandworm Team" "T1590","Gather Victim Network Information","Reconnaissance","HAFNIUM" "T1589.003","Employee Names","Reconnaissance","Silent Librarian|Sandworm Team" -"T1589.002","Email Addresses","Reconnaissance","TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team" -"T1589.001","Credentials","Reconnaissance","APT28|Magic Hound|Chimera" -"T1589","Gather Victim Identity Information","Reconnaissance","APT32" +"T1589.002","Email Addresses","Reconnaissance","Kimsuky|Magic Hound|TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team" +"T1589.001","Credentials","Reconnaissance","Leviathan|APT28|Magic Hound|Chimera" +"T1589","Gather Victim Identity Information","Reconnaissance","Magic Hound|APT32" "T1588.005","Exploits","Resource Development","no" "T1588.004","Digital Certificates","Resource Development","Lazarus Group|Silent Librarian" "T1588.003","Code Signing Certificates","Resource Development","Wizard Spider" -"T1588.002","Tool","Resource Development","MuddyWater|Silent Librarian|GALLIUM|Sandworm Team" -"T1588.001","Malware","Resource Development","Turla|APT1" +"T1588.002","Tool","Resource Development","CostaRicto|Night Dragon|DarkVishnya|FIN5|Gorgon Group|Patchwork|Chimera|Dragonfly|Blue Mockingbird|Whitefly|APT41|FIN6|TEMP.Veles|Kimsuky|PittyTiger|Cobalt Group|APT29|Thrip|Ke3chang|DarkHydrus|APT32|APT38|BRONZE BUTLER|Carbanak|Cleaver|Inception|Leafminer|Threat Group-3390|Ferocious Kitten|IndigoZebra|BackdoorDiplomacy|menuPass|APT-C-36|Magic Hound|APT28|Wizard Spider|Frankenstein|Silence|WIRTE|Turla|APT33|APT19|FIN10|CopyKittens|APT39|APT1|MuddyWater|Silent Librarian|GALLIUM|Sandworm Team" +"T1588.001","Malware","Resource Development","Andariel|BackdoorDiplomacy|Turla|APT1" "T1588","Obtain Capabilities","Resource Development","no" "T1587.004","Exploits","Resource Development","no" "T1587.003","Digital Certificates","Resource Development","APT29|PROMETHIUM" "T1587.002","Code Signing Certificates","Resource Development","PROMETHIUM|Patchwork" -"T1587.001","Malware","Resource Development","APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver" +"T1587.001","Malware","Resource Development","TeamTNT|APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver" "T1587","Develop Capabilities","Resource Development","Kimsuky" -"T1586.002","Email Accounts","Resource Development","Magic Hound|Kimsuky" -"T1586.001","Social Media Accounts","Resource Development","no" +"T1586.002","Email Accounts","Resource Development","IndigoZebra|Leviathan|Magic Hound|Kimsuky" +"T1586.001","Social Media Accounts","Resource Development","Leviathan" "T1586","Compromise Accounts","Resource Development","no" -"T1585.002","Email Accounts","Resource Development","Magic Hound|Silent Librarian|Sandworm Team|APT1" -"T1585.001","Social Media Accounts","Resource Development","Fox Kitten|Sandworm Team|APT32|Cleaver" +"T1585.002","Email Accounts","Resource Development","Leviathan|Magic Hound|Silent Librarian|Sandworm Team|APT1" +"T1585.001","Social Media Accounts","Resource Development","Leviathan|Magic Hound|Fox Kitten|Sandworm Team|APT32|Cleaver" "T1585","Establish Accounts","Resource Development","Fox Kitten|APT17" "T1584.006","Web Services","Resource Development","Turla" "T1584.005","Botnet","Resource Development","no" "T1584.004","Server","Resource Development","Indrik Spider|Turla|APT16" "T1584.003","Virtual Private Server","Resource Development","Turla" "T1584.002","DNS Server","Resource Development","no" -"T1584.001","Domains","Resource Development","APT29|UNC2452|APT1" -"T1583.006","Web Services","Resource Development","ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29" +"T1584.001","Domains","Resource Development","Transparent Tribe|Magic Hound|APT29|UNC2452|APT1" +"T1583.006","Web Services","Resource Development","IndigoZebra|ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29" "T1583.005","Botnet","Resource Development","no" "T1583.004","Server","Resource Development","GALLIUM|Sandworm Team" "T1583.003","Virtual Private Server","Resource Development","HAFNIUM|TEMP.Veles" "T1583.002","DNS Server","Resource Development","no" "T1584","Compromise Infrastructure","Resource Development","no" -"T1583.001","Domains","Resource Development","APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28" +"T1583.001","Domains","Resource Development","IndigoZebra|TeamTNT|Ferocious Kitten|FIN7|Transparent Tribe|Leviathan|Magic Hound|APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28" "T1583","Acquire Infrastructure","Resource Development","no" "T1564.007","VBA Stomping","Defense Evasion","no" "T1558.004","AS-REP Roasting","Credential Access","no" @@ -128,9 +143,9 @@ "T1556.003","Pluggable Authentication Modules","Credential Access|Defense Evasion|Persistence","no" "T1574.012","COR_PROFILER","Persistence|Privilege Escalation|Defense Evasion","Blue Mockingbird" "T1562.007","Disable or Modify Cloud Firewall","Defense Evasion","no" -"T1098.004","SSH Authorized Keys","Persistence","no" +"T1098.004","SSH Authorized Keys","Persistence","TeamTNT" "T1480.001","Environmental Keying","Defense Evasion","APT41|Equation" -"T1059.007","JavaScript","Execution","MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer" +"T1059.007","JavaScript","Execution","Indrik Spider|MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer" "T1578.004","Revert Cloud Instance","Defense Evasion","no" "T1578.003","Delete Cloud Instance","Defense Evasion","no" "T1578.001","Create Snapshot","Defense Evasion","no" @@ -147,10 +162,10 @@ "T1071.004","DNS","Command And Control","Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7" "T1071.003","Mail Protocols","Command And Control","Turla|Kimsuky|APT32|SilverTerrier|APT28" "T1071.002","File Transfer Protocols","Command And Control","Kimsuky|APT41|SilverTerrier|Honeybee" -"T1071.001","Web Protocols","Command And Control","APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT19|Cobalt Group|Rancor|Orangeworm|Threat Group-3390|Ke3chang|Turla|APT37|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|Magic Hound|OilRig|Gamaredon Group|Stealth Falcon" -"T1572","Protocol Tunneling","Command And Control","Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6" +"T1071.001","Web Protocols","Command And Control","TeamTNT|FIN8|APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT37|APT19|Ke3chang|Rancor|Orangeworm|Cobalt Group|Threat Group-3390|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon" +"T1572","Protocol Tunneling","Command And Control","Leviathan|CostaRicto|Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6" "T1048.003","Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol","Exfiltration","Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group" -"T1048.002","Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","Exfiltration","APT29|UNC2452" +"T1048.002","Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","Exfiltration","APT28|APT29|UNC2452" "T1048.001","Exfiltration Over Symmetric Encrypted Non-C2 Protocol","Exfiltration","no" "T1001.003","Protocol Impersonation","Command And Control","Higaisa|Lazarus Group" "T1001.002","Steganography","Command And Control","APT29|Axiom" @@ -158,25 +173,25 @@ "T1132.002","Non-Standard Encoding","Command And Control","no" "T1132.001","Standard Encoding","Command And Control","HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork" "T1090.004","Domain Fronting","Command And Control","APT29" -"T1090.003","Multi-hop Proxy","Command And Control","APT28|Operation Wocao|Inception|FIN4|APT29" -"T1090.002","External Proxy","Command And Control","APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28" +"T1090.003","Multi-hop Proxy","Command And Control","Leviathan|CostaRicto|APT28|Operation Wocao|Inception|FIN4|APT29" +"T1090.002","External Proxy","Command And Control","Tonto Team|APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28" "T1090.001","Internal Proxy","Command And Control","APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider" "T1102.003","One-Way Communication","Command And Control","Leviathan" -"T1102.002","Bidirectional Communication","Command And Control","ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak" +"T1102.002","Bidirectional Communication","Command And Control","ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak" "T1102.001","Dead Drop Resolver","Command And Control","Rocke|APT41|BRONZE BUTLER|RTM|Patchwork" "T1571","Non-Standard Port","Command And Control","Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7" -"T1074.002","Remote Data Staging","Collection","APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8" -"T1074.001","Local Data Staging","Collection","Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28" -"T1078.004","Cloud Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","APT33" +"T1074.002","Remote Data Staging","Collection","Leviathan|APT28|APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8" +"T1074.001","Local Data Staging","Collection","Indrik Spider|BackdoorDiplomacy|Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28" +"T1078.004","Cloud Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","APT28|APT33" "T1564.004","NTFS File Attributes","Defense Evasion","APT32" -"T1564.003","Hidden Window","Defense Evasion","Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound" -"T1078.003","Local Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32" -"T1078.002","Domain Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314" +"T1564.003","Hidden Window","Defense Evasion","Nomadic Octopus|Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound" +"T1078.003","Local Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","Kimsuky|HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32" +"T1078.002","Domain Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","Naikon|Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314" "T1078.001","Default Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","no" -"T1564.002","Hidden Users","Defense Evasion","no" +"T1564.002","Hidden Users","Defense Evasion","Dragonfly 2.0" "T1574.006","Dynamic Linker Hijacking","Persistence|Privilege Escalation|Defense Evasion","APT41|Rocke" "T1574.002","DLL Side-Loading","Persistence|Privilege Escalation|Defense Evasion","Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390" -"T1574.001","DLL Search Order Hijacking","Persistence|Privilege Escalation|Defense Evasion","Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass" +"T1574.001","DLL Search Order Hijacking","Persistence|Privilege Escalation|Defense Evasion","BackdoorDiplomacy|Tonto Team|Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass" "T1574.008","Path Interception by Search Order Hijacking","Persistence|Privilege Escalation|Defense Evasion","no" "T1574.007","Path Interception by PATH Environment Variable","Persistence|Privilege Escalation|Defense Evasion","no" "T1574.009","Path Interception by Unquoted Path","Persistence|Privilege Escalation|Defense Evasion","no" @@ -184,61 +199,61 @@ "T1574.005","Executable Installer File Permissions Weakness","Persistence|Privilege Escalation|Defense Evasion","no" "T1574.010","Services File Permissions Weakness","Persistence|Privilege Escalation|Defense Evasion","no" "T1574","Hijack Execution Flow","Persistence|Privilege Escalation|Defense Evasion","no" -"T1069.001","Local Groups","Discovery","Chimera|Operation Wocao|Turla|OilRig|admin@338" -"T1570","Lateral Tool Transfer","Lateral Movement","Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10" +"T1069.001","Local Groups","Discovery","Tonto Team|Chimera|Operation Wocao|Turla|OilRig|admin@338" +"T1570","Lateral Tool Transfer","Lateral Movement","Sandworm Team|Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10" "T1568.003","DNS Calculation","Command And Control","APT12" -"T1204.002","Malicious File","Execution","Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|BRONZE BUTLER|FIN7|Dragonfly 2.0|APT19|Dark Caracal|Cobalt Group|Gorgon Group|Patchwork|MuddyWater|DarkHydrus|OilRig|APT32|Rancor|Lazarus Group|APT29|APT28|APT37|FIN8|Elderwood|menuPass|PLATINUM|TA459|Leviathan" -"T1204.001","Malicious Link","Execution","APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla" +"T1204.002","Malicious File","Execution","Nomadic Octopus|Indrik Spider|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Tonto Team|Magic Hound|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|FIN7|Dark Caracal|Cobalt Group|DarkHydrus|OilRig|APT19|BRONZE BUTLER|Rancor|MuddyWater|Gorgon Group|Patchwork|APT32|Lazarus Group|APT37|Leviathan|APT29|menuPass|PLATINUM|TA459|APT28|FIN8|Elderwood" +"T1204.001","Malicious Link","Execution","FIN7|Transparent Tribe|APT3|Magic Hound|APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33" "T1195.003","Compromise Hardware Supply Chain","Initial Access","no" "T1195.002","Compromise Software Supply Chain","Initial Access","APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41" "T1195.001","Compromise Software Dependencies and Development Tools","Initial Access","no" "T1568.001","Fast Flux DNS","Command And Control","menuPass|TA505" "T1052.001","Exfiltration over USB","Exfiltration","Mustang Panda|Tropic Trooper" -"T1569.002","Service Execution","Execution","Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang" +"T1569.002","Service Execution","Execution","APT38|Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang" "T1569.001","Launchctl","Execution","no" "T1569","System Services","Execution","no" "T1568.002","Domain Generation Algorithms","Command And Control","TA551|APT41" -"T1568","Dynamic Resolution","Command And Control","APT29|UNC2452" +"T1568","Dynamic Resolution","Command And Control","Transparent Tribe|APT29|UNC2452" "T1011.001","Exfiltration Over Bluetooth","Exfiltration","no" -"T1567.002","Exfiltration to Cloud Storage","Exfiltration","ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla" +"T1567.002","Exfiltration to Cloud Storage","Exfiltration","FIN7|ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla" "T1567.001","Exfiltration to Code Repository","Exfiltration","no" -"T1059.006","Python","Execution","ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete" -"T1059.005","Visual Basic","Execution","Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound" -"T1059.004","Unix Shell","Execution","Rocke|APT41" -"T1059.003","Windows Command Shell","Execution","APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Rancor|Ke3chang|Dragonfly 2.0|Leviathan|APT37|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1" +"T1059.006","Python","Execution","Tonto Team|APT37|ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete" +"T1059.005","Visual Basic","Execution","OilRig|APT38|Transparent Tribe|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound" +"T1059.004","Unix Shell","Execution","TeamTNT|Rocke|APT41" +"T1059.003","Windows Command Shell","Execution","Sandworm Team|Nomadic Octopus|TeamTNT|APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Ke3chang|Rancor|FIN8|APT37|APT28|Magic Hound|BRONZE BUTLER|Sowbug|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1" "T1059.002","AppleScript","Execution","no" -"T1059.001","PowerShell","Execution","Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|Dragonfly 2.0|APT28|Thrip|Cobalt Group|DarkHydrus|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|Magic Hound|CopyKittens|OilRig|BRONZE BUTLER|FIN10|Threat Group-3390|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda" +"T1059.001","PowerShell","Execution","Nomadic Octopus|TeamTNT|APT38|Tonto Team|Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Thrip|DarkHydrus|Cobalt Group|Dragonfly 2.0|APT28|Gorgon Group|APT19|TA459|Leviathan|MuddyWater|FIN8|OilRig|CopyKittens|Magic Hound|BRONZE BUTLER|APT32|FIN10|FIN7|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda" "T1567","Exfiltration Over Web Service","Exfiltration","APT28" "T1497.003","Time Based Evasion","Defense Evasion|Discovery","no" "T1497.002","User Activity Based Checks","Defense Evasion|Discovery","Darkhotel|FIN7" -"T1497.001","System Checks","Defense Evasion|Discovery","Darkhotel|Evilnum|Frankenstein" +"T1497.001","System Checks","Defense Evasion|Discovery","OilRig|Darkhotel|Evilnum|Frankenstein" "T1498.002","Reflection Amplification","Impact","no" "T1498.001","Direct Network Flood","Impact","no" -"T1566.003","Spearphishing via Service","Initial Access","Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal" -"T1566.002","Spearphishing Link","Initial Access","Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT33|APT29|Leviathan|Elderwood|FIN8|Patchwork|Magic Hound" -"T1566.001","Spearphishing Attachment","Initial Access","Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|APT19|Lazarus Group|OilRig|APT32|BRONZE BUTLER|Dragonfly 2.0|MuddyWater|APT28|FIN8|TA459|Elderwood|APT29|Leviathan|Patchwork|APT37|menuPass|PLATINUM" +"T1566.003","Spearphishing via Service","Initial Access","APT29|Ajax Security Team|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal" +"T1566.002","Spearphishing Link","Initial Access","Transparent Tribe|FIN7|APT3|Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|FIN8|APT29|Leviathan|Patchwork|Magic Hound" +"T1566.001","Spearphishing Attachment","Initial Access","APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Nomadic Octopus|Tonto Team|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|OilRig|BRONZE BUTLER|Cobalt Group|Rancor|DarkHydrus|Lazarus Group|APT19|APT32|FIN7|Dragonfly 2.0|MuddyWater|APT28|Leviathan|FIN8|TA459|APT29|APT37|Patchwork|menuPass|PLATINUM|Elderwood" "T1566","Phishing","Initial Access","GOLD SOUTHFIELD|Dragonfly" "T1565.003","Runtime Data Manipulation","Impact","APT38" "T1565.002","Transmitted Data Manipulation","Impact","APT38" -"T1565.001","Stored Data Manipulation","Impact","FIN4|APT38" +"T1565.001","Stored Data Manipulation","Impact","APT38" "T1565","Data Manipulation","Impact","no" -"T1564.001","Hidden Files and Directories","Defense Evasion","Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28" +"T1564.001","Hidden Files and Directories","Defense Evasion","Transparent Tribe|Mustang Panda|Rocke|APT32|Tropic Trooper|APT28|Lazarus Group" "T1564","Hide Artifacts","Defense Evasion","no" "T1563.002","RDP Hijacking","Lateral Movement","no" "T1563.001","SSH Hijacking","Lateral Movement","no" "T1563","Remote Service Session Hijacking","Lateral Movement","no" -"T1518.001","Security Software Discovery","Discovery","Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon" +"T1518.001","Security Software Discovery","Discovery","TeamTNT|APT38|Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon" "T1069.003","Cloud Groups","Discovery","no" "T1069.002","Domain Groups","Discovery","Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang" "T1087.004","Cloud Account","Discovery","no" "T1087.003","Email Account","Discovery","Sandworm Team|TA505" -"T1087.002","Domain Account","Discovery","MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang" +"T1087.002","Domain Account","Discovery","MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang" "T1087.001","Local Account","Discovery","Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338" "T1553.004","Install Root Certificate","Defense Evasion","no" -"T1562.004","Disable or Modify System Firewall","Defense Evasion","APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak" -"T1562.003","Impair Command History Logging","Defense Evasion","no" -"T1562.002","Disable Windows Event Logging","Defense Evasion","APT29|UNC2452|Threat Group-3390" -"T1562.001","Disable or Modify Tools","Defense Evasion","APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda" +"T1562.004","Disable or Modify System Firewall","Defense Evasion","TeamTNT|APT38|APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak" +"T1562.003","Impair Command History Logging","Defense Evasion","APT38" +"T1562.002","Disable Windows Event Logging","Defense Evasion","Sandworm Team|APT29|UNC2452|Threat Group-3390" +"T1562.001","Disable or Modify Tools","Defense Evasion","TeamTNT|Indrik Spider|APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda" "T1562","Impair Defenses","Defense Evasion","no" "T1003.004","LSA Secrets","Credential Access","OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390" "T1003.005","Cached Domain Credentials","Credential Access","OilRig|MuddyWater|Leafminer|APT33" @@ -247,8 +262,8 @@ "T1561","Disk Wipe","Impact","no" "T1560.003","Archive via Custom Method","Collection","Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6" "T1560.002","Archive via Library","Collection","Lazarus Group|Threat Group-3390" -"T1560.001","Archive via Utility","Collection","APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang" -"T1560","Archive Collected Data","Collection","menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang" +"T1560.001","Archive via Utility","Collection","APT28|APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang" +"T1560","Archive Collected Data","Collection","Leviathan|menuPass|APT32|Patchwork|Honeybee|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang" "T1499.004","Application or System Exploitation","Impact","no" "T1499.003","Application Exhaustion Flood","Impact","no" "T1499.002","Service Exhaustion Flood","Impact","no" @@ -256,79 +271,79 @@ "T1491.002","External Defacement","Impact","Sandworm Team" "T1491.001","Internal Defacement","Impact","Lazarus Group" "T1114.003","Email Forwarding Rule","Collection","Silent Librarian|Kimsuky" -"T1114.002","Remote Email Collection","Collection","APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang" +"T1114.002","Remote Email Collection","Collection","APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|Leafminer|APT28|Ke3chang" "T1114.001","Local Email Collection","Collection","Chimera|Magic Hound|APT1" "T1134.005","SID-History Injection","Defense Evasion|Privilege Escalation","no" "T1134.004","Parent PID Spoofing","Defense Evasion|Privilege Escalation","no" "T1134.003","Make and Impersonate Token","Defense Evasion|Privilege Escalation","no" "T1134.002","Create Process with Token","Defense Evasion|Privilege Escalation","Turla|Lazarus Group" -"T1134.001","Token Impersonation/Theft","Defense Evasion|Privilege Escalation","APT28" +"T1134.001","Token Impersonation/Theft","Defense Evasion|Privilege Escalation","FIN8|APT28" "T1213.002","Sharepoint","Collection","Chimera|Ke3chang|APT28" "T1213.001","Confluence","Collection","no" "T1555.003","Credentials from Web Browsers","Credential Access","Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats" "T1555.002","Securityd Memory","Credential Access","no" "T1555.001","Keychain","Credential Access","no" -"T1559.002","Dynamic Data Exchange","Execution","Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7" +"T1559.002","Dynamic Data Exchange","Execution","Leviathan|Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7" "T1559.001","Component Object Model","Execution","Gamaredon Group|MuddyWater" "T1559","Inter-Process Communication","Execution","no" "T1558.002","Silver Ticket","Credential Access","no" "T1558.001","Golden Ticket","Credential Access","Ke3chang" "T1558","Steal or Forge Kerberos Tickets","Credential Access","no" "T1557.001","LLMNR/NBT-NS Poisoning and SMB Relay","Credential Access|Collection","Wizard Spider" -"T1557","Man-in-the-Middle","Credential Access|Collection","Kimsuky" +"T1557","Adversary-in-the-Middle","Credential Access|Collection","Kimsuky" "T1556.002","Password Filter DLL","Credential Access|Defense Evasion|Persistence","Strider" "T1556.001","Domain Controller Authentication","Credential Access|Defense Evasion|Persistence","Chimera" "T1556","Modify Authentication Process","Credential Access|Defense Evasion|Persistence","no" "T1056.004","Credential API Hooking","Collection|Credential Access","PLATINUM" "T1056.003","Web Portal Capture","Collection|Credential Access","no" "T1056.002","GUI Input Capture","Collection|Credential Access","FIN4" -"T1056.001","Keylogging","Collection|Credential Access","Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28" +"T1056.001","Keylogging","Collection|Credential Access","Tonto Team|Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28" "T1555","Credentials from Password Stores","Credential Access","APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon" -"T1552.005","Cloud Instance Metadata API","Credential Access","no" +"T1552.005","Cloud Instance Metadata API","Credential Access","TeamTNT" "T1003.008","/etc/passwd and /etc/shadow","Credential Access","no" "T1003.007","Proc Filesystem","Credential Access","no" "T1003.006","DCSync","Credential Access","APT29|UNC2452|Operation Wocao" -"T1558.003","Kerberoasting","Credential Access","APT29|UNC2452|Operation Wocao|Wizard Spider" +"T1558.003","Kerberoasting","Credential Access","FIN7|APT29|UNC2452|Operation Wocao|Wizard Spider" "T1552.006","Group Policy Preferences","Credential Access","APT33" -"T1003.003","NTDS","Credential Access","Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0" +"T1003.003","NTDS","Credential Access","APT28|Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0" "T1003.002","Security Account Manager","Credential Access","Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass" -"T1003.001","LSASS Memory","Credential Access","HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|MuddyWater|PLATINUM|FIN8|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver" +"T1003.001","LSASS Memory","Credential Access","Indrik Spider|HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Magic Hound|Leafminer|PLATINUM|FIN8|MuddyWater|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver" "T1110.004","Credential Stuffing","Credential Access","Chimera" -"T1110.003","Password Spraying","Credential Access","Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group" +"T1110.003","Password Spraying","Credential Access","Sandworm Team|APT29|Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group" "T1110.002","Password Cracking","Credential Access","FIN6|APT41|Dragonfly 2.0|APT3" "T1110.001","Password Guessing","Credential Access","APT28" "T1021.006","Windows Remote Management","Lateral Movement","APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390" -"T1021.005","VNC","Lateral Movement","Fox Kitten|GCMAN" -"T1021.004","SSH","Lateral Movement","Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN" +"T1021.005","VNC","Lateral Movement","FIN7|Fox Kitten|GCMAN" +"T1021.004","SSH","Lateral Movement","TeamTNT|FIN7|Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN" "T1021.003","Distributed Component Object Model","Lateral Movement","no" -"T1021.002","SMB/Windows Admin Shares","Lateral Movement","Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang" -"T1021.001","Remote Desktop Protocol","Lateral Movement","Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom" +"T1021.002","SMB/Windows Admin Shares","Lateral Movement","Sandworm Team|APT28|Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang" +"T1021.001","Remote Desktop Protocol","Lateral Movement","Kimsuky|FIN7|Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom" "T1554","Compromise Client Software Binary","Persistence","no" "T1036.006","Space after Filename","Defense Evasion","no" -"T1036.005","Match Legitimate Name or Location","Defense Evasion","APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1" -"T1036.004","Masquerade Task or Service","Defense Evasion","ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7" +"T1036.005","Match Legitimate Name or Location","Defense Evasion","APT28|Ferocious Kitten|FIN7|BackdoorDiplomacy|Transparent Tribe|Naikon|APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1" +"T1036.004","Masquerade Task or Service","Defense Evasion","BackdoorDiplomacy|APT41|Naikon|ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7" "T1036.003","Rename System Utilities","Defense Evasion","menuPass|APT32|GALLIUM" -"T1036.002","Right-to-Left Override","Defense Evasion","BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic" +"T1036.002","Right-to-Left Override","Defense Evasion","Ferocious Kitten|BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic" "T1036.001","Invalid Code Signature","Defense Evasion","Windshift|APT37" "T1553.003","SIP and Trust Provider Hijacking","Defense Evasion","no" -"T1553.002","Code Signing","Defense Evasion","APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel" +"T1553.002","Code Signing","Defense Evasion","menuPass|APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel" "T1553.001","Gatekeeper Bypass","Defense Evasion","no" "T1553","Subvert Trust Controls","Defense Evasion","no" -"T1027.003","Steganography","Defense Evasion","TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37" -"T1027.002","Software Packing","Defense Evasion","ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon" -"T1027.001","Binary Padding","Defense Evasion","Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee" -"T1222.002","Linux and Mac File and Directory Permissions Modification","Defense Evasion","Rocke|APT32" +"T1027.003","Steganography","Defense Evasion","Andariel|Leviathan|TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37" +"T1027.002","Software Packing","Defense Evasion","Sandworm Team|Kimsuky|TeamTNT|ZIRCONIUM|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon" +"T1027.001","Binary Padding","Defense Evasion","APT29|Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee" +"T1222.002","Linux and Mac File and Directory Permissions Modification","Defense Evasion","TeamTNT|Rocke|APT32" "T1222.001","Windows File and Directory Permissions Modification","Defense Evasion","Wizard Spider" -"T1552.004","Private Keys","Credential Access","APT29|UNC2452|Operation Wocao|Rocke" +"T1552.004","Private Keys","Credential Access","TeamTNT|APT29|UNC2452|Operation Wocao|Rocke" "T1552.003","Bash History","Credential Access","no" "T1552.002","Credentials in Registry","Credential Access","APT32" -"T1552.001","Credentials In Files","Credential Access","Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3" +"T1552.001","Credentials In Files","Credential Access","TeamTNT|Kimsuky|Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3" "T1552","Unsecured Credentials","Credential Access","no" "T1216.001","PubPrn","Defense Evasion","APT32" -"T1070.006","Timestomp","Defense Evasion","APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28" +"T1070.006","Timestomp","Defense Evasion","APT38|APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28" "T1070.005","Network Share Connection Removal","Defense Evasion","Threat Group-3390" -"T1070.004","File Deletion","Defense Evasion","APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|Threat Group-3390|FIN10|APT28|Group5|Lazarus Group|APT18|APT29" -"T1070.003","Clear Command History","Defense Evasion","APT41" +"T1070.004","File Deletion","Defense Evasion","TeamTNT|APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Honeybee|Cobalt Group|Dragonfly 2.0|Patchwork|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|APT3|Magic Hound|APT28|FIN10|Threat Group-3390|Group5|Lazarus Group|APT18|APT29" +"T1070.003","Clear Command History","Defense Evasion","TeamTNT|menuPass|APT41" "T1550.004","Web Session Cookie","Defense Evasion|Lateral Movement","APT29|UNC2452" "T1550.001","Application Access Token","Defense Evasion|Lateral Movement","APT28" "T1550.003","Pass the Ticket","Defense Evasion|Lateral Movement","APT32|BRONZE BUTLER|APT29" @@ -340,17 +355,17 @@ "T1548.001","Setuid and Setgid","Privilege Escalation|Defense Evasion","no" "T1548","Abuse Elevation Control Mechanism","Privilege Escalation|Defense Evasion","no" "T1136.003","Cloud Account","Persistence","no" -"T1070.002","Clear Linux or Mac System Logs","Defense Evasion","Rocke" -"T1070.001","Clear Windows Event Logs","Defense Evasion","Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28" -"T1136.002","Domain Account","Persistence","HAFNIUM|GALLIUM" -"T1136.001","Local Account","Persistence","Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3" +"T1070.002","Clear Linux or Mac System Logs","Defense Evasion","TeamTNT|Rocke" +"T1070.001","Clear Windows Event Logs","Defense Evasion","Indrik Spider|Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28" +"T1136.002","Domain Account","Persistence","Sandworm Team|HAFNIUM|GALLIUM" +"T1136.001","Local Account","Persistence","TeamTNT|Fox Kitten|APT39|APT41|Leafminer|Dragonfly 2.0|APT3" "T1547.011","Plist Modification","Persistence|Privilege Escalation","no" "T1547.010","Port Monitors","Persistence|Privilege Escalation","no" -"T1547.009","Shortcut Modification","Persistence|Privilege Escalation","APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan" +"T1547.009","Shortcut Modification","Persistence|Privilege Escalation","APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group" "T1547.008","LSASS Driver","Persistence|Privilege Escalation","no" "T1547.007","Re-opened Applications","Persistence|Privilege Escalation","no" "T1547.006","Kernel Modules and Extensions","Persistence|Privilege Escalation","no" -"T1547.005","Security Support Provider","Persistence|Privilege Escalation","Lazarus Group" +"T1547.005","Security Support Provider","Persistence|Privilege Escalation","no" "T1547.004","Winlogon Helper DLL","Persistence|Privilege Escalation","Wizard Spider|Tropic Trooper|Turla" "T1547.003","Time Providers","Persistence|Privilege Escalation","no" "T1546.014","Emond","Privilege Escalation|Persistence","no" @@ -367,40 +382,40 @@ "T1546.006","LC_LOAD_DYLIB Addition","Privilege Escalation|Persistence","no" "T1546.005","Trap","Privilege Escalation|Persistence","no" "T1546.004","Unix Shell Configuration Modification","Privilege Escalation|Persistence","no" -"T1546.003","Windows Management Instrumentation Event Subscription","Privilege Escalation|Persistence","Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29" +"T1546.003","Windows Management Instrumentation Event Subscription","Privilege Escalation|Persistence","FIN8|Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29" "T1546.002","Screensaver","Privilege Escalation|Persistence","no" "T1546.001","Change Default File Association","Privilege Escalation|Persistence","Kimsuky" -"T1547.001","Registry Run Keys / Startup Folder","Persistence|Privilege Escalation","Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Honeybee|Dark Caracal|Threat Group-3390|Cobalt Group|Ke3chang|Gorgon Group|Dragonfly 2.0|APT37|MuddyWater|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel" +"T1547.001","Registry Run Keys / Startup Folder","Persistence|Privilege Escalation","TeamTNT|Naikon|Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Turla|Honeybee|Cobalt Group|Ke3chang|Dragonfly 2.0|APT19|Gorgon Group|MuddyWater|Leviathan|APT37|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel" "T1218.002","Control Panel","Defense Evasion","no" -"T1218.010","Regsvr32","Defense Evasion","TA551|Blue Mockingbird|Inception|WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda" +"T1218.010","Regsvr32","Defense Evasion","TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda" "T1218.009","Regsvcs/Regasm","Defense Evasion","no" -"T1218.005","Mshta","Defense Evasion","Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7" +"T1218.005","Mshta","Defense Evasion","Mustang Panda|TA551|Sidewinder|Inception|Kimsuky|APT32|MuddyWater|FIN7" "T1218.004","InstallUtil","Defense Evasion","Mustang Panda|menuPass" -"T1218.001","Compiled HTML File","Defense Evasion","APT41|Silence|Lazarus Group|Dark Caracal|OilRig" +"T1218.001","Compiled HTML File","Defense Evasion","APT41|Silence|Dark Caracal|Lazarus Group|OilRig" "T1218.003","CMSTP","Defense Evasion","Cobalt Group|MuddyWater" -"T1218.011","Rundll32","Defense Evasion","HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28" +"T1218.011","Rundll32","Defense Evasion","APT38|HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28" "T1547","Boot or Logon Autostart Execution","Persistence|Privilege Escalation","no" "T1546","Event Triggered Execution","Privilege Escalation|Persistence","no" "T1098.003","Add Office 365 Global Administrator Role","Persistence","no" -"T1098.002","Exchange Email Delegate Permissions","Persistence","APT29|UNC2452|Magic Hound" +"T1098.002","Exchange Email Delegate Permissions","Persistence","APT28|APT29|UNC2452|Magic Hound" "T1098.001","Additional Cloud Credentials","Persistence","APT29|UNC2452" "T1543.004","Launch Daemon","Persistence|Privilege Escalation","no" -"T1543.003","Windows Service","Persistence|Privilege Escalation","PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Honeybee|Threat Group-3390|APT3|Lazarus Group|Carbanak" -"T1543.002","Systemd Service","Persistence|Privilege Escalation","Rocke" +"T1543.003","Windows Service","Persistence|Privilege Escalation","TeamTNT|APT38|PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Threat Group-3390|Honeybee|APT3|Lazarus Group|Carbanak" +"T1543.002","Systemd Service","Persistence|Privilege Escalation","TeamTNT|Rocke" "T1543.001","Launch Agent","Persistence|Privilege Escalation","no" "T1037.005","Startup Items","Persistence|Privilege Escalation","no" "T1037.004","RC Scripts","Persistence|Privilege Escalation","no" -"T1055.012","Process Hollowing","Defense Evasion|Privilege Escalation","Threat Group-3390|Gorgon Group|menuPass|Patchwork" +"T1055.012","Process Hollowing","Defense Evasion|Privilege Escalation","Threat Group-3390|menuPass|Gorgon Group|Patchwork" "T1055.013","Process Doppelgänging","Defense Evasion|Privilege Escalation","Leafminer" "T1055.011","Extra Window Memory Injection","Defense Evasion|Privilege Escalation","no" "T1055.014","VDSO Hijacking","Defense Evasion|Privilege Escalation","no" "T1055.009","Proc Memory","Defense Evasion|Privilege Escalation","no" "T1055.008","Ptrace System Calls","Defense Evasion|Privilege Escalation","no" "T1055.005","Thread Local Storage","Defense Evasion|Privilege Escalation","no" -"T1055.004","Asynchronous Procedure Call","Defense Evasion|Privilege Escalation","no" +"T1055.004","Asynchronous Procedure Call","Defense Evasion|Privilege Escalation","FIN8" "T1055.003","Thread Execution Hijacking","Defense Evasion|Privilege Escalation","no" "T1055.002","Portable Executable Injection","Defense Evasion|Privilege Escalation","Rocke|Gorgon Group" -"T1055.001","Dynamic-link Library Injection","Defense Evasion|Privilege Escalation","Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda" +"T1055.001","Dynamic-link Library Injection","Defense Evasion|Privilege Escalation","BackdoorDiplomacy|Leviathan|Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda" "T1037.003","Network Logon Script","Persistence|Privilege Escalation","no" "T1543","Create or Modify System Process","Persistence|Privilege Escalation","no" "T1037.002","Logon Script (Mac)","Persistence|Privilege Escalation","no" @@ -408,13 +423,13 @@ "T1542.003","Bootkit","Persistence|Defense Evasion","APT41|Lazarus Group|APT28" "T1542.002","Component Firmware","Persistence|Defense Evasion","Equation" "T1542.001","System Firmware","Persistence|Defense Evasion","no" -"T1505.003","Web Shell","Persistence","Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda" +"T1505.003","Web Shell","Persistence","BackdoorDiplomacy|APT38|APT29|APT28|Tonto Team|Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda" "T1505.002","Transport Agent","Persistence","no" -"T1505.001","SQL Stored Procedures","Persistence","no" -"T1053.003","Cron","Execution|Persistence|Privilege Escalation","Rocke" +"T1505.001","SQL Stored Procedures","Persistence","Sandworm Team" +"T1053.003","Cron","Execution|Persistence|Privilege Escalation","APT38|Rocke" "T1053.004","Launchd","Execution|Persistence|Privilege Escalation","no" "T1053.001","At (Linux)","Execution|Persistence|Privilege Escalation","no" -"T1053.005","Scheduled Task","Execution|Persistence|Privilege Escalation","Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Rancor|Dragonfly 2.0|OilRig|Patchwork|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29" +"T1053.005","Scheduled Task","Execution|Persistence|Privilege Escalation","APT37|APT38|Naikon|CostaRicto|Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Rancor|Dragonfly 2.0|Cobalt Group|OilRig|Patchwork|FIN8|FIN10|FIN7|menuPass|APT32|Stealth Falcon|FIN6|APT3|APT29" "T1053.002","At (Windows)","Execution|Persistence|Privilege Escalation","BRONZE BUTLER|Threat Group-3390|APT18" "T1542","Pre-OS Boot","Defense Evasion|Persistence","no" "T1137.001","Office Template Macros","Persistence","MuddyWater" @@ -428,7 +443,7 @@ "T1529","System Shutdown/Reboot","Impact","Lazarus Group|APT38|APT37" "T1518","Software Discovery","Discovery","Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception" "T1547.013","XDG Autostart Entries","Persistence|Privilege Escalation","no" -"T1534","Internal Spearphishing","Lateral Movement","Gamaredon Group" +"T1534","Internal Spearphishing","Lateral Movement","Leviathan|Gamaredon Group" "T1528","Steal Application Access Token","Credential Access","APT28" "T1535","Unused/Unsupported Cloud Regions","Defense Evasion","no" "T1525","Implant Internal Image","Persistence","no" @@ -441,124 +456,124 @@ "T1499","Endpoint Denial of Service","Impact","Sandworm Team" "T1497","Virtualization/Sandbox Evasion","Defense Evasion|Discovery","Darkhotel" "T1498","Network Denial of Service","Impact","APT28" -"T1496","Resource Hijacking","Impact","Blue Mockingbird|Rocke|APT41|Lazarus Group" +"T1496","Resource Hijacking","Impact","TeamTNT|Blue Mockingbird|Rocke|APT41" "T1495","Firmware Corruption","Impact","no" "T1491","Defacement","Impact","no" "T1490","Inhibit System Recovery","Impact","no" -"T1489","Service Stop","Impact","Wizard Spider|Lazarus Group" -"T1486","Data Encrypted for Impact","Impact","Indrik Spider|APT41|TA505|APT38" +"T1489","Service Stop","Impact","Indrik Spider|Wizard Spider|Lazarus Group" +"T1486","Data Encrypted for Impact","Impact","FIN7|Indrik Spider|APT41|TA505|APT38" "T1485","Data Destruction","Impact","Sandworm Team|Lazarus Group|APT38" "T1484","Domain Policy Modification","Defense Evasion|Privilege Escalation","no" -"T1482","Domain Trust Discovery","Discovery","APT29|Chimera|UNC2452" +"T1482","Domain Trust Discovery","Discovery","FIN8|APT29|Chimera|UNC2452" "T1480","Execution Guardrails","Defense Evasion","no" -"T1222","File and Directory Permissions Modification","Defense Evasion","no" -"T1220","XSL Script Processing","Defense Evasion","Higaisa|Cobalt Group" "T1221","Template Injection","Defense Evasion","Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus" -"T1189","Drive-by Compromise","Initial Access","Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|Leafminer|Lazarus Group|BRONZE BUTLER|APT19|APT32|Threat Group-3390|Dark Caracal|Elderwood|APT37|Patchwork|PLATINUM" -"T1190","Exploit Public-Facing Application","Initial Access","Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom" -"T1210","Exploitation of Remote Services","Lateral Movement","Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28" -"T1217","Browser Bookmark Discovery","Discovery","Chimera|Fox Kitten" -"T1213","Data from Information Repositories","Collection","Fox Kitten|FIN6|Turla" -"T1197","BITS Jobs","Defense Evasion|Persistence","APT39|Patchwork|APT41|Leviathan" -"T1219","Remote Access Software","Command And Control","Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak" -"T1195","Supply Chain Compromise","Initial Access","no" -"T1204","User Execution","Execution","no" +"T1220","XSL Script Processing","Defense Evasion","Higaisa|Cobalt Group" +"T1222","File and Directory Permissions Modification","Defense Evasion","no" +"T1217","Browser Bookmark Discovery","Discovery","APT38|Chimera|Fox Kitten" "T1212","Exploitation for Credential Access","Credential Access","no" -"T1211","Exploitation for Defense Evasion","Defense Evasion","APT28" -"T1200","Hardware Additions","Initial Access","DarkVishnya" -"T1202","Indirect Command Execution","Defense Evasion","no" "T1201","Password Policy Discovery","Discovery","Chimera|Turla|OilRig" -"T1207","Rogue Domain Controller","Defense Evasion","no" -"T1203","Exploitation for Client Execution","Execution","Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|Patchwork|APT29|TA459|Leviathan|Elderwood" +"T1195","Supply Chain Compromise","Initial Access","no" +"T1199","Trusted Relationship","Initial Access","APT29|Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass" +"T1203","Exploitation for Client Execution","Execution","Andariel|Transparent Tribe|APT3|Tonto Team|Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|APT29|TA459|APT37|Patchwork|Elderwood|Leviathan" +"T1202","Indirect Command Execution","Defense Evasion","no" +"T1197","BITS Jobs","Defense Evasion|Persistence","APT39|Patchwork|APT41|Leviathan" +"T1213","Data from Information Repositories","Collection","APT28|Fox Kitten|FIN6|Turla" "T1216","Signed Script Proxy Execution","Defense Evasion","no" -"T1199","Trusted Relationship","Initial Access","Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass" +"T1189","Drive-by Compromise","Initial Access","Transparent Tribe|Andariel|Leviathan|Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Lazarus Group|BRONZE BUTLER|Threat Group-3390|Dark Caracal|Dragonfly 2.0|Leafminer|APT19|APT32|APT37|Elderwood|Patchwork|PLATINUM" +"T1211","Exploitation for Defense Evasion","Defense Evasion","APT28" +"T1190","Exploit Public-Facing Application","Initial Access","BackdoorDiplomacy|menuPass|Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom" +"T1210","Exploitation of Remote Services","Lateral Movement","Tonto Team|FIN7|Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28" +"T1200","Hardware Additions","Initial Access","DarkVishnya" +"T1219","Remote Access Software","Command And Control","TeamTNT|Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak" +"T1207","Rogue Domain Controller","Defense Evasion","no" "T1218","Signed Binary Proxy Execution","Defense Evasion","no" "T1205","Traffic Signaling","Defense Evasion|Persistence|Command And Control","no" +"T1204","User Execution","Execution","no" "T1176","Browser Extensions","Persistence","Kimsuky|Stolen Pencil" "T1175","Component Object Model and Distributed COM","Lateral Movement|Execution","no" +"T1185","Browser Session Hijacking","Collection","no" "T1187","Forced Authentication","Credential Access","DarkHydrus|Dragonfly 2.0" -"T1185","Man in the Browser","Collection","no" -"T1149","LC_MAIN Hijacking","Defense Evasion","no" "T1134","Access Token Manipulation","Defense Evasion|Privilege Escalation","FIN6|Blue Mockingbird" -"T1136","Create Account","Persistence","no" +"T1136","Create Account","Persistence","Sandworm Team|Indrik Spider" +"T1135","Network Share Discovery","Discovery","Tonto Team|APT38|Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug" "T1137","Office Application Startup","Persistence","Gamaredon Group|APT32" -"T1140","Deobfuscate/Decode Files or Information","Defense Evasion","APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|menuPass|Honeybee|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER" -"T1135","Network Share Discovery","Discovery","Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug" "T1153","Source","Execution","no" -"T1133","External Remote Services","Persistence|Initial Access","APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18" +"T1140","Deobfuscate/Decode Files or Information","Defense Evasion","APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|Gorgon Group|Threat Group-3390|menuPass|APT19|MuddyWater|Leviathan|APT28|OilRig|BRONZE BUTLER" +"T1149","LC_MAIN Hijacking","Defense Evasion","no" +"T1133","External Remote Services","Persistence|Initial Access","TeamTNT|Leviathan|APT28|APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Ke3chang|Dragonfly 2.0|FIN5|Threat Group-3390|APT18" "T1132","Data Encoding","Command And Control","no" "T1129","Shared Modules","Execution","no" "T1127","Trusted Developer Utilities Proxy Execution","Defense Evasion","no" "T1125","Video Capture","Collection","Silence|FIN7" "T1124","System Time Discovery","Discovery","Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla" "T1123","Audio Capture","Collection","APT37" -"T1120","Peripheral Device Discovery","Discovery","Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28" +"T1120","Peripheral Device Discovery","Discovery","OilRig|BackdoorDiplomacy|Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28" "T1119","Automated Collection","Collection","Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6" "T1115","Clipboard Data","Collection","Operation Wocao|APT39|APT38" -"T1114","Email Collection","Collection","Silent Librarian" +"T1114","Email Collection","Collection","Magic Hound|Silent Librarian" "T1113","Screen Capture","Collection","GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28" -"T1112","Modify Registry","Defense Evasion","Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Patchwork|Gorgon Group|Honeybee|FIN8" +"T1112","Modify Registry","Defense Evasion","Operation Wocao|Kimsuky|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Dragonfly 2.0|Threat Group-3390|Gorgon Group|APT19|Honeybee|FIN8" "T1111","Two-Factor Authentication Interception","Credential Access","Chimera|Operation Wocao" -"T1110","Brute Force","Credential Access","APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla" +"T1110","Brute Force","Credential Access","APT38|APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla" "T1108","Redundant Access","Defense Evasion|Persistence","no" -"T1106","Native API","Execution","Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group" -"T1105","Ingress Tool Transfer","Command And Control","HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Gorgon Group|Turla|OilRig|Dragonfly 2.0|APT37|Leviathan|FIN8|PLATINUM|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28" +"T1106","Native API","Execution","APT38|Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group" +"T1105","Ingress Tool Transfer","Command And Control","TeamTNT|Nomadic Octopus|IndigoZebra|Andariel|BackdoorDiplomacy|Tonto Team|HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|OilRig|Turla|Gorgon Group|Cobalt Group|Dragonfly 2.0|APT37|PLATINUM|Leviathan|FIN8|Elderwood|Magic Hound|APT32|BRONZE BUTLER|APT3|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28" "T1104","Multi-Stage Channels","Command And Control","APT41|MuddyWater|APT3" -"T1102","Web Service","Command And Control","Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6" -"T1098","Account Manipulation","Persistence","APT3|Dragonfly 2.0|Lazarus Group" -"T1095","Non-Application Layer Protocol","Command And Control","HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3" +"T1102","Web Service","Command And Control","TeamTNT|FIN8|Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6" +"T1098","Account Manipulation","Persistence","Sandworm Team|APT3|Dragonfly 2.0|Lazarus Group" +"T1095","Non-Application Layer Protocol","Command And Control","BackdoorDiplomacy|HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3" "T1092","Communication Through Removable Media","Command And Control","APT28" "T1091","Replication Through Removable Media","Lateral Movement|Initial Access","Mustang Panda|Tropic Trooper|Darkhotel|APT28" "T1090","Proxy","Command And Control","Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla" "T1087","Account Discovery","Discovery","APT29|UNC2452" -"T1083","File and Directory Discovery","Discovery","APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Leafminer|Honeybee|Dark Caracal|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang" -"T1082","System Information Discovery","Discovery","APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang" +"T1083","File and Directory Discovery","Discovery","APT38|APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|APT3|Sowbug|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang" +"T1082","System Information Discovery","Discovery","TeamTNT|APT38|APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|OilRig|Sowbug|Magic Hound|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang" "T1080","Taint Shared Content","Lateral Movement","Gamaredon Group|BRONZE BUTLER|Darkhotel" -"T1078","Valid Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|OilRig|FIN5|menuPass|FIN10|APT28|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak" +"T1078","Valid Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","FIN7|Leviathan|APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|FIN5|OilRig|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak" "T1074","Data Staged","Collection","Wizard Spider" "T1072","Software Deployment Tools","Execution|Lateral Movement","Silence|APT32|Threat Group-1314" -"T1071","Application Layer Protocol","Command And Control","Rocke|Magic Hound|Dragonfly 2.0" +"T1071","Application Layer Protocol","Command And Control","TeamTNT|Rocke|Magic Hound|Dragonfly 2.0" "T1070","Indicator Removal on Host","Defense Evasion","APT29|UNC2452" "T1069","Permission Groups Discovery","Discovery","APT29|UNC2452|TA505|APT3" -"T1068","Exploitation for Privilege Escalation","Privilege Escalation","ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28" +"T1068","Exploitation for Privilege Escalation","Privilege Escalation","Tonto Team|ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28" "T1064","Scripting","Defense Evasion|Execution","no" "T1062","Hypervisor","Persistence","no" "T1061","Graphical User Interface","Execution","no" -"T1059","Command and Scripting Interpreter","Execution","Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang" -"T1057","Process Discovery","Discovery","APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang" +"T1059","Command and Scripting Interpreter","Execution","APT37|Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang" +"T1057","Process Discovery","Discovery","TeamTNT|Andariel|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang" "T1056","Input Capture","Collection|Credential Access","APT39" -"T1055","Process Injection","Defense Evasion|Privilege Escalation","Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM" +"T1055","Process Injection","Defense Evasion|Privilege Escalation","Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Cobalt Group|Turla|APT37|Honeybee|PLATINUM" "T1053","Scheduled Task/Job","Execution|Persistence|Privilege Escalation","no" "T1052","Exfiltration Over Physical Medium","Exfiltration","no" "T1051","Shared Webroot","Lateral Movement","no" -"T1049","System Network Connections Discovery","Discovery","Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang" +"T1049","System Network Connections Discovery","Discovery","TeamTNT|Andariel|BackdoorDiplomacy|Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang" "T1048","Exfiltration Over Alternative Protocol","Exfiltration","no" -"T1047","Windows Management Instrumentation","Execution","Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda" -"T1046","Network Service Scanning","Discovery","Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Leafminer|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390" -"T1043","Commonly Used Port","Command And Control","OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390" -"T1041","Exfiltration Over C2 Channel","Exfiltration","ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang" +"T1047","Windows Management Instrumentation","Execution","Sandworm Team|FIN7|Indrik Spider|Naikon|Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda" +"T1046","Network Service Scanning","Discovery","TeamTNT|BackdoorDiplomacy|Naikon|CostaRicto|Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Cobalt Group|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390" +"T1043","Commonly Used Port","Command And Control","OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|APT3|Magic Hound|Lazarus Group|Threat Group-3390" +"T1041","Exfiltration Over C2 Channel","Exfiltration","Leviathan|ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang" "T1040","Network Sniffing","Credential Access|Discovery","Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28" -"T1039","Data from Network Shared Drive","Collection","Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass" +"T1039","Data from Network Shared Drive","Collection","APT28|Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass" "T1037","Boot or Logon Initialization Scripts","Persistence|Privilege Escalation","Rocke" -"T1036","Masquerading","Defense Evasion","APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0" +"T1036","Masquerading","Defense Evasion","APT28|Nomadic Octopus|OilRig|APT29|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0" "T1034","Path Interception","Persistence|Privilege Escalation","no" -"T1033","System Owner/User Discovery","Discovery","Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3" -"T1030","Data Transfer Size Limits","Exfiltration","Threat Group-3390" +"T1033","System Owner/User Discovery","Discovery","APT38|Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT37|APT19|APT32|Dragonfly 2.0|Magic Hound|OilRig|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3" +"T1030","Data Transfer Size Limits","Exfiltration","APT28|Threat Group-3390" "T1029","Scheduled Transfer","Exfiltration","Higaisa" -"T1027","Obfuscated Files or Information","Defense Evasion","APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|APT37|Honeybee|menuPass|Leafminer|Cobalt Group|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|MuddyWater|Elderwood|Leviathan|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28" +"T1027","Obfuscated Files or Information","Defense Evasion","TeamTNT|BackdoorDiplomacy|Transparent Tribe|APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|Cobalt Group|APT37|Threat Group-3390|menuPass|Leafminer|Dark Caracal|Honeybee|APT19|BlackOasis|FIN8|MuddyWater|Leviathan|Elderwood|FIN7|OilRig|Magic Hound|APT3|APT32|Group5|Lazarus Group|Dust Storm|Putter Panda|APT28" "T1026","Multiband Communication","Command And Control","Lazarus Group" "T1025","Data from Removable Media","Collection","Turla|Gamaredon Group|APT28" "T1021","Remote Services","Lateral Movement","no" "T1020","Automated Exfiltration","Exfiltration","Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee" -"T1018","Remote System Discovery","Discovery","APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Dragonfly 2.0|Deep Panda|Threat Group-3390|Leafminer|Ke3chang|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla" -"T1016","System Network Configuration Discovery","Discovery","ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang" -"T1014","Rootkit","Defense Evasion","Rocke|APT41|APT28|Winnti Group" +"T1018","Remote System Discovery","Discovery","Indrik Spider|Naikon|APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Ke3chang|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla" +"T1016","System Network Configuration Discovery","Discovery","TeamTNT|ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|Threat Group-3390|menuPass|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang" +"T1014","Rootkit","Defense Evasion","TeamTNT|Rocke|APT41|APT28|Winnti Group" "T1012","Query Registry","Discovery","ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla" "T1011","Exfiltration Over Other Network Medium","Exfiltration","no" "T1010","Application Window Discovery","Discovery","Lazarus Group" -"T1008","Fallback Channels","Command And Control","Carbanak|APT41|OilRig|Lazarus Group" -"T1007","System Service Discovery","Discovery","Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang" +"T1008","Fallback Channels","Command And Control","FIN7|APT41|OilRig|Lazarus Group" +"T1007","System Service Discovery","Discovery","Indrik Spider|Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang" "T1006","Direct Volume Access","Defense Evasion","no" -"T1005","Data from Local System","Collection","APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang" -"T1003","OS Credential Dumping","Credential Access","APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom" +"T1005","Data from Local System","Collection","FIN7|APT41|APT38|Andariel|APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang" +"T1003","OS Credential Dumping","Credential Access","Tonto Team|APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom" "T1001","Data Obfuscation","Command And Control","Operation Wocao|Axiom" diff --git a/docs/_config.yml b/docs/_config.yml index 8c65e3d661..b69c7bb131 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -104,7 +104,7 @@ defaults: read_time: false comments: true share: true - related: true + related: false toc: true # _pages - scope: @@ -122,7 +122,7 @@ defaults: author_profile: false comments: true share: true - related: true + related: false toc: true # _playbooks - scope: diff --git a/docs/_pages/abuse.md b/docs/_pages/abuse.md index bd9312f75b..d079742c85 100644 --- a/docs/_pages/abuse.md +++ b/docs/_pages/abuse.md @@ -11,6 +11,6 @@ sidebar: | Name | Technique | Tactic | | ----------- | ----------- |--------------| | [Brand Monitoring]() | None | None | -| [DNS Amplification Attacks](/stories/dns_amplification_attacks/) | [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) | +| [DNS Amplification Attacks](/stories/dns_amplification_attacks/) | [Network Denial of Service](/tags/#network-denial-of-service), [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) | | [Data Protection](/stories/data_protection/) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) | -| [Netsh Abuse](/stories/netsh_abuse/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file +| [Netsh Abuse](/stories/netsh_abuse/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file diff --git a/docs/_pages/adversary_tactics.md b/docs/_pages/adversary_tactics.md index ab9dfdc2ce..f25364a284 100644 --- a/docs/_pages/adversary_tactics.md +++ b/docs/_pages/adversary_tactics.md @@ -10,52 +10,52 @@ sidebar: | Name | Technique | Tactic | | ----------- | ----------- |--------------| -| [Active Directory Discovery](/stories/active_directory_discovery/) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | -| [Active Directory Password Spraying](/stories/active_directory_password_spraying/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | +| [Active Directory Discovery](/stories/active_directory_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | +| [Active Directory Password Spraying](/stories/active_directory_password_spraying/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access) | | [BITS Jobs](/stories/bits_jobs/) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) | | [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Cobalt Strike](/stories/cobalt_strike/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Cobalt Strike](/stories/cobalt_strike/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [Defense Evasion](/tags/#defense-evasion) | | [Collection and Staging](/stories/collection_and_staging/) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | -| [Command and Control](/stories/command_and_control/) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | -| [Credential Dumping](/stories/credential_dumping/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | +| [Command and Control](/stories/command_and_control/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | +| [Credential Dumping](/stories/credential_dumping/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | | [DNS Hijacking](/stories/dns_hijacking/) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) | -| [Data Exfiltration](/stories/data_exfiltration/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) | +| [Data Exfiltration](/stories/data_exfiltration/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | | [Deobfuscate-Decode Files or Information](/stories/deobfuscate-decode_files_or_information/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) | | [Detect Zerologon Attack](/stories/detect_zerologon_attack/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | -| [Disabling Security Tools](/stories/disabling_security_tools/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | +| [Disabling Security Tools](/stories/disabling_security_tools/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | | [Domain Trust Discovery](/stories/domain_trust_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | | [F5 TMUI RCE CVE-2020-5902](/stories/f5_tmui_rce_cve-2020-5902/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | -| [HAFNIUM Group](/stories/hafnium_group/) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | +| [HAFNIUM Group](/stories/hafnium_group/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | | [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) | -| [Lateral Movement](/stories/lateral_movement/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | +| [Lateral Movement](/stories/lateral_movement/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | | [Malicious PowerShell](/stories/malicious_powershell/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) | -| [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | | [Meterpreter](/stories/meterpreter/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | -| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | +| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | | [NOBELIUM Group](/stories/nobelium_group/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | | [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | -| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Persistence](/tags/#persistence) | -| [ProxyShell](/stories/proxyshell/) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | +| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) | +| [ProxyShell](/stories/proxyshell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | | [SQL Injection](/stories/sql_injection/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | | [Silver Sparrow](/stories/silver_sparrow/) | [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection) | -| [Spearphishing Attachments](/stories/spearphishing_attachments/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | -| [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity/) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | +| [Spearphishing Attachments](/stories/spearphishing_attachments/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | +| [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious DNS Traffic](/stories/suspicious_dns_traffic/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | -| [Suspicious Emails](/stories/suspicious_emails/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | -| [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Okta Activity](/stories/suspicious_okta_activity/) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity/) | [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Emails](/stories/suspicious_emails/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | [Initial Access](/tags/#initial-access) | +| [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Okta Activity](/stories/suspicious_okta_activity/) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious WMI Use](/stories/suspicious_wmi_use/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) | -| [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities/) | [Application Shimming](/tags/#application-shimming) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | | [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) | -| [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [Defense Evasion](/tags/#defense-evasion) | | [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) | -| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | | [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) | -| [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | -| [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) | \ No newline at end of file +| [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | +| [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) | \ No newline at end of file diff --git a/docs/_pages/best_practices.md b/docs/_pages/best_practices.md index 6114be8754..dc03339daa 100644 --- a/docs/_pages/best_practices.md +++ b/docs/_pages/best_practices.md @@ -12,6 +12,6 @@ sidebar: | ----------- | ----------- |--------------| | [Asset Tracking]() | None | None | | [Monitor for Updates]() | None | None | -| [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch/) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | -| [Router and Infrastructure Security](/stories/router_and_infrastructure_security/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) | +| [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | +| [Router and Infrastructure Security](/stories/router_and_infrastructure_security/) | [Hardware Additions](/tags/#hardware-additions), [Automated Exfiltration](/tags/#automated-exfiltration), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) | | [Use of Cleartext Protocols]() | None | None | \ No newline at end of file diff --git a/docs/_pages/cloud_security.md b/docs/_pages/cloud_security.md index 4ecc062563..1e113284d0 100644 --- a/docs/_pages/cloud_security.md +++ b/docs/_pages/cloud_security.md @@ -11,18 +11,18 @@ sidebar: | Name | Technique | Tactic | | ----------- | ----------- |--------------| | [AWS Cross Account Activity](/stories/aws_cross_account_activity/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) | -| [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation/) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) | -| [AWS Network ACL Activity](/stories/aws_network_acl_activity/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) | +| [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | [Persistence](/tags/#persistence) | +| [AWS Network ACL Activity](/stories/aws_network_acl_activity/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | | [AWS Security Hub Alerts]() | None | None | | [AWS User Monitoring](/stories/aws_user_monitoring/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | | [Cloud Cryptomining](/stories/cloud_cryptomining/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | -| [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution) | [Privilege Escalation](/tags/#privilege-escalation) | | [Container Implantation Monitoring and Investigation](/stories/container_implantation_monitoring_and_investigation/) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) | | [Dev Sec Ops](/stories/dev_sec_ops/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | | [GCP Cross Account Activity](/stories/gcp_cross_account_activity/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | | [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | | [Kubernetes Sensitive Object Access Activity]() | None | None | -| [Office 365 Detections](/stories/office_365_detections/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | [Collection](/tags/#collection) | +| [Office 365 Detections](/stories/office_365_detections/) | [Email Forwarding Rule](/tags/#email-forwarding-rule), [Email Collection](/tags/#email-collection) | [Collection](/tags/#collection) | | [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | | [Suspicious AWS Traffic]() | None | None | diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index 25fa3d4300..53ede289f2 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -10,107 +10,109 @@ sidebar: | Name | Technique | Type | | --------| --------- |------------| -| [7zip CommandLine To SMB Share Path](/endpoint/7zip_commandline_to_smb_share_path/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | -| [AWS Create Policy Version to allow all resources](/cloud/aws_create_policy_version_to_allow_all_resources/) | [Cloud Accounts](/tags/#cloud-accounts) | TTP | -| [AWS CreateAccessKey](/cloud/aws_createaccesskey/) | [Cloud Account](/tags/#cloud-account) | Hunting | -| [AWS CreateLoginProfile](/cloud/aws_createloginprofile/) | [Cloud Account](/tags/#cloud-account) | TTP | +| [7zip CommandLine To SMB Share Path](/endpoint/7zip_commandline_to_smb_share_path/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting | +| [AWS Create Policy Version to allow all resources](/cloud/aws_create_policy_version_to_allow_all_resources/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | TTP | +| [AWS CreateAccessKey](/cloud/aws_createaccesskey/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | Hunting | +| [AWS CreateLoginProfile](/cloud/aws_createloginprofile/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | | [AWS Cross Account Activity From Previously Unseen Account]() | None | Anomaly | | [AWS Detect Users creating keys with encrypt policy without MFA](/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | TTP | | [AWS Detect Users with KMS keys performing encryption S3](/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly | -| [AWS ECR Container Scanning Findings High](/cloud/aws_ecr_container_scanning_findings_high/) | [Malicious Image](/tags/#malicious-image) | TTP | -| [AWS ECR Container Scanning Findings Low Informational Unknown](/cloud/aws_ecr_container_scanning_findings_low_informational_unknown/) | [Malicious Image](/tags/#malicious-image) | Hunting | -| [AWS ECR Container Scanning Findings Medium](/cloud/aws_ecr_container_scanning_findings_medium/) | [Malicious Image](/tags/#malicious-image) | Anomaly | -| [AWS ECR Container Upload Outside Business Hours](/cloud/aws_ecr_container_upload_outside_business_hours/) | [Malicious Image](/tags/#malicious-image) | Anomaly | -| [AWS ECR Container Upload Unknown User](/cloud/aws_ecr_container_upload_unknown_user/) | [Malicious Image](/tags/#malicious-image) | Anomaly | +| [AWS ECR Container Scanning Findings High](/cloud/aws_ecr_container_scanning_findings_high/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | TTP | +| [AWS ECR Container Scanning Findings Low Informational Unknown](/cloud/aws_ecr_container_scanning_findings_low_informational_unknown/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Hunting | +| [AWS ECR Container Scanning Findings Medium](/cloud/aws_ecr_container_scanning_findings_medium/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Anomaly | +| [AWS ECR Container Upload Outside Business Hours](/cloud/aws_ecr_container_upload_outside_business_hours/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Anomaly | +| [AWS ECR Container Upload Unknown User](/cloud/aws_ecr_container_upload_unknown_user/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Anomaly | | [AWS Excessive Security Scanning](/cloud/aws_excessive_security_scanning/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | TTP | | [AWS IAM AccessDenied Discovery Events](/cloud/aws_iam_accessdenied_discovery_events/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery) | Anomaly | | [AWS IAM Assume Role Policy Brute Force](/cloud/aws_iam_assume_role_policy_brute_force/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force) | TTP | | [AWS IAM Delete Policy](/cloud/aws_iam_delete_policy/) | [Account Manipulation](/tags/#account-manipulation) | Hunting | | [AWS IAM Failure Group Deletion](/cloud/aws_iam_failure_group_deletion/) | [Account Manipulation](/tags/#account-manipulation) | Anomaly | -| [AWS IAM Successful Group Deletion](/cloud/aws_iam_successful_group_deletion/) | [Cloud Groups](/tags/#cloud-groups), [Account Manipulation](/tags/#account-manipulation) | Hunting | -| [AWS Network Access Control List Created with All Open Ports](/cloud/aws_network_access_control_list_created_with_all_open_ports/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | -| [AWS Network Access Control List Deleted](/cloud/aws_network_access_control_list_deleted/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | Anomaly | +| [AWS IAM Successful Group Deletion](/cloud/aws_iam_successful_group_deletion/) | [Cloud Groups](/tags/#cloud-groups), [Account Manipulation](/tags/#account-manipulation), [Permission Groups Discovery](/tags/#permission-groups-discovery) | Hunting | +| [AWS Network Access Control List Created with All Open Ports](/cloud/aws_network_access_control_list_created_with_all_open_ports/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [AWS Network Access Control List Deleted](/cloud/aws_network_access_control_list_deleted/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | Anomaly | | [AWS SAML Access by Provider User and Principal](/cloud/aws_saml_access_by_provider_user_and_principal/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | | [AWS SAML Update identity provider](/cloud/aws_saml_update_identity_provider/) | [Valid Accounts](/tags/#valid-accounts) | TTP | -| [AWS SetDefaultPolicyVersion](/cloud/aws_setdefaultpolicyversion/) | [Cloud Accounts](/tags/#cloud-accounts) | TTP | -| [AWS UpdateLoginProfile](/cloud/aws_updateloginprofile/) | [Cloud Account](/tags/#cloud-account) | TTP | -| [Abnormally High Number Of Cloud Infrastructure API Calls](/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | -| [Abnormally High Number Of Cloud Instances Destroyed](/cloud/abnormally_high_number_of_cloud_instances_destroyed/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | -| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | -| [Abnormally High Number Of Cloud Security Group API Calls](/cloud/abnormally_high_number_of_cloud_security_group_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | -| [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | TTP | -| [Add DefaultUser And Password In Registry](/endpoint/add_defaultuser_and_password_in_registry/) | [Credentials in Registry](/tags/#credentials-in-registry) | Anomaly | -| [AdsiSearcher Account Discovery](/endpoint/adsisearcher_account_discovery/) | [Domain Account](/tags/#domain-account) | TTP | -| [Allow File And Printing Sharing In Firewall](/endpoint/allow_file_and_printing_sharing_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | -| [Allow Inbound Traffic By Firewall Rule Registry](/endpoint/allow_inbound_traffic_by_firewall_rule_registry/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | -| [Allow Inbound Traffic In Firewall Rule](/endpoint/allow_inbound_traffic_in_firewall_rule/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | -| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | +| [AWS SetDefaultPolicyVersion](/cloud/aws_setdefaultpolicyversion/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | TTP | +| [AWS UpdateLoginProfile](/cloud/aws_updateloginprofile/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | +| [Abnormally High Number Of Cloud Infrastructure API Calls](/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Instances Destroyed](/cloud/abnormally_high_number_of_cloud_instances_destroyed/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Security Group API Calls](/cloud/abnormally_high_number_of_cloud_security_group_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | +| [Active Setup Registry Autostart](/endpoint/active_setup_registry_autostart/) | [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Add DefaultUser And Password In Registry](/endpoint/add_defaultuser_and_password_in_registry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | Anomaly | +| [AdsiSearcher Account Discovery](/endpoint/adsisearcher_account_discovery/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | +| [Allow File And Printing Sharing In Firewall](/endpoint/allow_file_and_printing_sharing_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Allow Inbound Traffic By Firewall Rule Registry](/endpoint/allow_inbound_traffic_by_firewall_rule_registry/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | TTP | +| [Allow Inbound Traffic In Firewall Rule](/endpoint/allow_inbound_traffic_in_firewall_rule/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | TTP | +| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Allow Operation with Consent Admin](/endpoint/allow_operation_with_consent_admin/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [Amazon EKS Kubernetes Pod scan detection](/cloud/amazon_eks_kubernetes_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | Hunting | | [Amazon EKS Kubernetes cluster scan detection](/cloud/amazon_eks_kubernetes_cluster_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | Hunting | -| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility) | Anomaly | -| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [PowerShell](/tags/#powershell) | TTP | -| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell) | TTP | +| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Anomaly | +| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [Applying Stolen Credentials via Mimikatz modules](/endpoint/applying_stolen_credentials_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | | [Applying Stolen Credentials via PowerSploit modules](/endpoint/applying_stolen_credentials_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | | [Assessment of Credential Strength via DSInternals modules](/endpoint/assessment_of_credential_strength_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | TTP | -| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Attempt To Add Certificate To Untrusted Store](/endpoint/attempt_to_add_certificate_to_untrusted_store/) | [Install Root Certificate](/tags/#install-root-certificate) | TTP | +| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning) | TTP | +| [Attempt To Add Certificate To Untrusted Store](/endpoint/attempt_to_add_certificate_to_untrusted_store/) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls) | TTP | | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP | -| [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Attempt To delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop) | TTP | | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager) | TTP | -| [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP | | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [BITS Job Persistence](/endpoint/bits_job_persistence/) | [BITS Jobs](/tags/#bits-jobs) | TTP | | [BITSAdmin Download File](/endpoint/bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | -| [Batch File Write to System32](/endpoint/batch_file_write_to_system32/) | [Malicious File](/tags/#malicious-file) | TTP | +| [Batch File Write to System32](/endpoint/batch_file_write_to_system32/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | TTP | | [Bcdedit Command Back To Normal Mode Boot](/endpoint/bcdedit_command_back_to_normal_mode_boot/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [CHCP Command Execution](/endpoint/chcp_command_execution/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | -| [CMD Echo Pipe - Escalation](/endpoint/cmd_echo_pipe_-_escalation/) | [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service) | TTP | -| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [CMSTP](/tags/#cmstp) | TTP | +| [CMD Echo Pipe - Escalation](/endpoint/cmd_echo_pipe_-_escalation/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP | | [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [CertUtil Download With VerifyCtl and Split Arguments](/endpoint/certutil_download_with_verifyctl_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [CertUtil With Decode Argument](/endpoint/certutil_with_decode_argument/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | TTP | | [Certutil exe certificate extraction]() | None | TTP | +| [Change Default File Association](/endpoint/change_default_file_association/) | [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | | [Change To Safe Mode With Network Config](/endpoint/change_to_safe_mode_with_network_config/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Check Elevated CMD using whoami](/endpoint/check_elevated_cmd_using_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | TTP | | [Child Processes of Spoolsv exe](/endpoint/child_processes_of_spoolsv_exe/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | | [Circle CI Disable Security Job](/cloud/circle_ci_disable_security_job/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | Anomaly | | [Circle CI Disable Security Step](/cloud/circle_ci_disable_security_step/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | Anomaly | -| [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion) | TTP | +| [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | | [Clop Common Exec Parameter](/endpoint/clop_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP | | [Clop Ransomware Known Service Name](/endpoint/clop_ransomware_known_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Cloud API Calls From Previously Unseen User Roles](/cloud/cloud_api_calls_from_previously_unseen_user_roles/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | -| [Cloud Compute Instance Created By Previously Unseen User](/cloud/cloud_compute_instance_created_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Cloud Compute Instance Created By Previously Unseen User](/cloud/cloud_compute_instance_created_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | | [Cloud Compute Instance Created In Previously Unused Region](/cloud/cloud_compute_instance_created_in_previously_unused_region/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Anomaly | | [Cloud Compute Instance Created With Previously Unseen Image]() | None | Anomaly | | [Cloud Compute Instance Created With Previously Unseen Instance Type]() | None | Anomaly | -| [Cloud Instance Modified By Previously Unseen User](/cloud/cloud_instance_modified_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Cloud Instance Modified By Previously Unseen User](/cloud/cloud_instance_modified_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | | [Cloud Provisioning Activity From Previously Unseen City](/cloud/cloud_provisioning_activity_from_previously_unseen_city/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | | [Cloud Provisioning Activity From Previously Unseen Country](/cloud/cloud_provisioning_activity_from_previously_unseen_country/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | | [Cloud Provisioning Activity From Previously Unseen IP Address](/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | | [Cloud Provisioning Activity From Previously Unseen Region](/cloud/cloud_provisioning_activity_from_previously_unseen_region/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | -| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [JavaScript](/tags/#javascript) | TTP | +| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | TTP | | [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection) | TTP | | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP | -| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Control Panel](/tags/#control-panel) | TTP | -| [Correlation by Repository and Risk](/cloud/correlation_by_repository_and_risk/) | [Malicious Image](/tags/#malicious-image) | Correlation | -| [Correlation by User and Risk](/cloud/correlation_by_user_and_risk/) | [Malicious Image](/tags/#malicious-image) | Correlation | +| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel) | TTP | +| [Correlation by Repository and Risk](/cloud/correlation_by_repository_and_risk/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Correlation | +| [Correlation by User and Risk](/cloud/correlation_by_user_and_risk/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Correlation | | [Create Remote Thread In Shell Application](/endpoint/create_remote_thread_in_shell_application/) | [Process Injection](/tags/#process-injection) | TTP | -| [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Create Service In Suspicious File Path](/endpoint/create_service_in_suspicious_file_path/) | [Service Execution](/tags/#service-execution) | TTP | -| [Create local admin accounts using net exe](/endpoint/create_local_admin_accounts_using_net_exe/) | [Local Account](/tags/#local-account) | TTP | -| [Create or delete windows shares using net exe](/endpoint/create_or_delete_windows_shares_using_net_exe/) | [Network Share Connection Removal](/tags/#network-share-connection-removal) | TTP | -| [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds) | TTP | -| [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds) | TTP | -| [Creation of lsass Dump with Taskmgr](/endpoint/creation_of_lsass_dump_with_taskmgr/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Credential Dumping via Copy Command from Shadow Copy](/endpoint/credential_dumping_via_copy_command_from_shadow_copy/) | [NTDS](/tags/#ntds) | TTP | -| [Credential Dumping via Symlink to Shadow Copy](/endpoint/credential_dumping_via_symlink_to_shadow_copy/) | [NTDS](/tags/#ntds) | TTP | +| [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Create Service In Suspicious File Path](/endpoint/create_service_in_suspicious_file_path/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | TTP | +| [Create local admin accounts using net exe](/endpoint/create_local_admin_accounts_using_net_exe/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | TTP | +| [Create or delete windows shares using net exe](/endpoint/create_or_delete_windows_shares_using_net_exe/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Network Share Connection Removal](/tags/#network-share-connection-removal) | TTP | +| [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Creation of lsass Dump with Taskmgr](/endpoint/creation_of_lsass_dump_with_taskmgr/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Dumping via Copy Command from Shadow Copy](/endpoint/credential_dumping_via_copy_command_from_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Dumping via Symlink to Shadow Copy](/endpoint/credential_dumping_via_symlink_to_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of FGDump and CacheDump with s option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of FGDump and CacheDump with v option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of Lazagne command line options](/endpoint/credential_extraction_indicative_of_lazagne_command_line_options/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | TTP | @@ -123,230 +125,234 @@ sidebar: | [Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals](/endpoint/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [DLLHost with no Command Line Arguments with Network](/endpoint/dllhost_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | TTP | | [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | -| [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns) | Anomaly | -| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | +| [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol) | Anomaly | +| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | | [DSQuery Domain Discovery](/endpoint/dsquery_domain_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [Delete A Net User](/endpoint/delete_a_net_user/) | [Service Stop](/tags/#service-stop) | Anomaly | | [Delete ShadowCopy With PowerShell](/endpoint/delete_shadowcopy_with_powershell/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Deleting Of Net Users](/endpoint/deleting_of_net_users/) | [Account Access Removal](/tags/#account-access-removal) | TTP | | [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Deny Permission using Cacls Utility](/endpoint/deny_permission_using_cacls_utility/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | -| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | | [Detect AWS Console Login by New User]() | None | Hunting | | [Detect AWS Console Login by User from New City](/cloud/detect_aws_console_login_by_user_from_new_city/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting | | [Detect AWS Console Login by User from New Country](/cloud/detect_aws_console_login_by_user_from_new_country/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting | | [Detect AWS Console Login by User from New Region](/cloud/detect_aws_console_login_by_user_from_new_region/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting | -| [Detect Activity Related to Pass the Hash Attacks](/endpoint/detect_activity_related_to_pass_the_hash_attacks/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | -| [Detect AzureHound Command-Line Arguments](/endpoint/detect_azurehound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | -| [Detect AzureHound File Modifications](/endpoint/detect_azurehound_file_modifications/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | +| [Detect Activity Related to Pass the Hash Attacks](/endpoint/detect_activity_related_to_pass_the_hash_attacks/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [Detect AzureHound Command-Line Arguments](/endpoint/detect_azurehound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | TTP | +| [Detect AzureHound File Modifications](/endpoint/detect_azurehound_file_modifications/) | [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | TTP | | [Detect Baron Samedit CVE-2021-3156](/endpoint/detect_baron_samedit_cve-2021-3156/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | | [Detect Baron Samedit CVE-2021-3156 Segfault](/endpoint/detect_baron_samedit_cve-2021-3156_segfault/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | | [Detect Baron Samedit CVE-2021-3156 via OSQuery](/endpoint/detect_baron_samedit_cve-2021-3156_via_osquery/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | | [Detect Computer Changed with Anonymous Account](/endpoint/detect_computer_changed_with_anonymous_account/) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services) | Hunting | -| [Detect Copy of ShadowCopy with Script Block Logging](/endpoint/detect_copy_of_shadowcopy_with_script_block_logging/) | [Security Account Manager](/tags/#security-account-manager) | TTP | -| [Detect Credential Dumping through LSASS access](/endpoint/detect_credential_dumping_through_lsass_access/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Detect Dump LSASS Memory using comsvcs](/endpoint/detect_dump_lsass_memory_using_comsvcs/) | [NTDS](/tags/#ntds) | TTP | -| [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [PowerShell](/tags/#powershell) | TTP | -| [Detect Excessive Account Lockouts From Endpoint](/endpoint/detect_excessive_account_lockouts_from_endpoint/) | [Domain Accounts](/tags/#domain-accounts) | Anomaly | -| [Detect Excessive User Account Lockouts](/endpoint/detect_excessive_user_account_lockouts/) | [Local Accounts](/tags/#local-accounts) | Anomaly | -| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Web Shell](/tags/#web-shell) | TTP | +| [Detect Copy of ShadowCopy with Script Block Logging](/endpoint/detect_copy_of_shadowcopy_with_script_block_logging/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Detect Credential Dumping through LSASS access](/endpoint/detect_credential_dumping_through_lsass_access/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Detect Dump LSASS Memory using comsvcs](/endpoint/detect_dump_lsass_memory_using_comsvcs/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [Detect Excessive Account Lockouts From Endpoint](/endpoint/detect_excessive_account_lockouts_from_endpoint/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | Anomaly | +| [Detect Excessive User Account Lockouts](/endpoint/detect_excessive_user_account_lockouts/) | [Valid Accounts](/tags/#valid-accounts), [Local Accounts](/tags/#local-accounts) | Anomaly | +| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | TTP | | [Detect F5 TMUI RCE CVE-2020-5902](/web/detect_f5_tmui_rce_cve-2020-5902/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | | [Detect GCP Storage access from a new IP](/cloud/detect_gcp_storage_access_from_a_new_ip/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | Anomaly | -| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [Compiled HTML File](/tags/#compiled-html-file) | Hunting | -| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Compiled HTML File](/tags/#compiled-html-file) | TTP | -| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Compiled HTML File](/tags/#compiled-html-file) | TTP | -| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Compiled HTML File](/tags/#compiled-html-file) | TTP | -| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | -| [Detect Kerberoasting](/endpoint/detect_kerberoasting/) | [Kerberoasting](/tags/#kerberoasting) | TTP | +| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | Hunting | +| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP | +| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP | +| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP | +| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect Kerberoasting](/endpoint/detect_kerberoasting/) | [Kerberoasting](/tags/#kerberoasting), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | | [Detect Large Outbound ICMP Packets](/network/detect_large_outbound_icmp_packets/) | [Non-Application Layer Protocol](/tags/#non-application-layer-protocol) | TTP | -| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Mshta](/tags/#mshta) | TTP | -| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory) | TTP | +| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account) | TTP | +| [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | TTP | | [Detect New Login Attempts to Routers]() | None | TTP | | [Detect New Open GCP Storage Buckets](/cloud/detect_new_open_gcp_storage_buckets/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | TTP | | [Detect New Open S3 Buckets over AWS CLI](/cloud/detect_new_open_s3_buckets_over_aws_cli/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | TTP | | [Detect New Open S3 buckets](/cloud/detect_new_open_s3_buckets/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | TTP | -| [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols) | TTP | -| [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Detect Pass the Hash](/endpoint/detect_pass_the_hash/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | -| [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path) | TTP | -| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell) | Hunting | +| [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | TTP | +| [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Detect Pass the Hash](/endpoint/detect_pass_the_hash/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | +| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | -| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | | [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP | | [Detect Rare Executables]() | None | Anomaly | -| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | -| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | -| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | -| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | -| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | -| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | -| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Regsvr32](/tags/#regsvr32) | TTP | -| [Detect Renamed 7-Zip](/endpoint/detect_renamed_7-zip/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | -| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [Service Execution](/tags/#service-execution) | Hunting | +| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | TTP | +| [Detect Renamed 7-Zip](/endpoint/detect_renamed_7-zip/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting | +| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting | | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Hunting | -| [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | +| [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting | | [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle) | TTP | -| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Rundll32](/tags/#rundll32) | TTP | -| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Rundll32](/tags/#rundll32) | TTP | -| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Rundll32](/tags/#rundll32) | TTP | -| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Mshta](/tags/#mshta) | TTP | +| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | | [Detect S3 access from a new IP](/cloud/detect_s3_access_from_a_new_ip/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | Anomaly | | [Detect SNICat SNI Exfiltration](/network/detect_snicat_sni_exfiltration/) | [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel) | TTP | -| [Detect SharpHound Command-Line Arguments](/endpoint/detect_sharphound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | -| [Detect SharpHound File Modifications](/endpoint/detect_sharphound_file_modifications/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | -| [Detect SharpHound Usage](/endpoint/detect_sharphound_usage/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | -| [Detect Software Download To Network Device](/network/detect_software_download_to_network_device/) | [TFTP Boot](/tags/#tftp-boot) | TTP | +| [Detect SharpHound Command-Line Arguments](/endpoint/detect_sharphound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | TTP | +| [Detect SharpHound File Modifications](/endpoint/detect_sharphound_file_modifications/) | [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | TTP | +| [Detect SharpHound Usage](/endpoint/detect_sharphound_usage/) | [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | TTP | +| [Detect Software Download To Network Device](/network/detect_software_download_to_network_device/) | [TFTP Boot](/tags/#tftp-boot), [Pre-OS Boot](/tags/#pre-os-boot) | TTP | | [Detect Spike in AWS Security Hub Alerts for EC2 Instance]() | None | Anomaly | | [Detect Spike in AWS Security Hub Alerts for User]() | None | Anomaly | | [Detect Spike in S3 Bucket deletion](/cloud/detect_spike_in_s3_bucket_deletion/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | Anomaly | | [Detect Spike in blocked Outbound Traffic from your AWS]() | None | Anomaly | -| [Detect Traffic Mirroring](/network/detect_traffic_mirroring/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | TTP | +| [Detect Traffic Mirroring](/network/detect_traffic_mirroring/) | [Hardware Additions](/tags/#hardware-additions), [Automated Exfiltration](/tags/#automated-exfiltration), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | TTP | | [Detect Unauthorized Assets by MAC address]() | None | TTP | -| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Windows Command Shell](/tags/#windows-command-shell) | TTP | -| [Detect WMI Event Subscription Persistence](/endpoint/detect_wmi_event_subscription_persistence/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription) | TTP | +| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | TTP | +| [Detect WMI Event Subscription Persistence](/endpoint/detect_wmi_event_subscription_persistence/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | | [Detect Windows DNS SIGRed via Splunk Stream](/network/detect_windows_dns_sigred_via_splunk_stream/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | TTP | | [Detect Windows DNS SIGRed via Zeek](/network/detect_windows_dns_sigred_via_zeek/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | TTP | | [Detect Zerologon via Zeek](/network/detect_zerologon_via_zeek/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | | [Detect attackers scanning for vulnerable JBoss servers](/web/detect_attackers_scanning_for_vulnerable_jboss_servers/) | [System Information Discovery](/tags/#system-information-discovery) | TTP | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | TTP | | [Detect malicious requests to exploit JBoss servers]() | None | TTP | -| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Mshta](/tags/#mshta) | TTP | -| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [Mshta](/tags/#mshta) | Hunting | +| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | Hunting | | [Detect processes used for System Network Configuration Discovery](/endpoint/detect_processes_used_for_system_network_configuration_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | TTP | | [Detect shared ec2 snapshot](/cloud/detect_shared_ec2_snapshot/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | TTP | | [Detection of tools built by NirSoft](/endpoint/detection_of_tools_built_by_nirsoft/) | [Software Deployment Tools](/tags/#software-deployment-tools) | TTP | -| [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disable ETW Through Registry](/endpoint/disable_etw_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disable Logs Using WevtUtil](/endpoint/disable_logs_using_wevtutil/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disable ETW Through Registry](/endpoint/disable_etw_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disable Logs Using WevtUtil](/endpoint/disable_logs_using_wevtutil/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | | [Disable Net User Account](/endpoint/disable_net_user_account/) | [Service Stop](/tags/#service-stop) | TTP | -| [Disable Registry Tool](/endpoint/disable_registry_tool/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disable Windows App Hotkeys](/endpoint/disable_windows_app_hotkeys/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling CMD Application](/endpoint/disabling_cmd_application/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling ControlPanel](/endpoint/disabling_controlpanel/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling Firewall with Netsh](/endpoint/disabling_firewall_with_netsh/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling FolderOptions Windows Feature](/endpoint/disabling_folderoptions_windows_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disable Registry Tool](/endpoint/disable_registry_tool/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disable Security Logs Using MiniNt Registry](/endpoint/disable_security_logs_using_minint_registry/) | [Modify Registry](/tags/#modify-registry) | TTP | +| [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hide Artifacts](/tags/#hide-artifacts), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Disable Windows App Hotkeys](/endpoint/disable_windows_app_hotkeys/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling CMD Application](/endpoint/disabling_cmd_application/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling ControlPanel](/endpoint/disabling_controlpanel/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling Firewall with Netsh](/endpoint/disabling_firewall_with_netsh/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling FolderOptions Windows Feature](/endpoint/disabling_folderoptions_windows_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Disabling Net User Account](/endpoint/disabling_net_user_account/) | [Account Access Removal](/tags/#account-access-removal) | TTP | -| [Disabling NoRun Windows App](/endpoint/disabling_norun_windows_app/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling Task Manager](/endpoint/disabling_task_manager/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Domain Account Discovery With Net App](/endpoint/domain_account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | TTP | -| [Domain Account Discovery with Dsquery](/endpoint/domain_account_discovery_with_dsquery/) | [Domain Account](/tags/#domain-account) | Hunting | -| [Domain Account Discovery with Wmic](/endpoint/domain_account_discovery_with_wmic/) | [Domain Account](/tags/#domain-account) | TTP | +| [Disabling NoRun Windows App](/endpoint/disabling_norun_windows_app/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling Task Manager](/endpoint/disabling_task_manager/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Domain Account Discovery With Net App](/endpoint/domain_account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | +| [Domain Account Discovery with Dsquery](/endpoint/domain_account_discovery_with_dsquery/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | Hunting | +| [Domain Account Discovery with Wmic](/endpoint/domain_account_discovery_with_wmic/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | | [Domain Controller Discovery with Nltest](/endpoint/domain_controller_discovery_with_nltest/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | | [Domain Controller Discovery with Wmic](/endpoint/domain_controller_discovery_with_wmic/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | -| [Domain Group Discovery With Dsquery](/endpoint/domain_group_discovery_with_dsquery/) | [Domain Groups](/tags/#domain-groups) | Hunting | -| [Domain Group Discovery With Net](/endpoint/domain_group_discovery_with_net/) | [Domain Groups](/tags/#domain-groups) | Hunting | -| [Domain Group Discovery With Wmic](/endpoint/domain_group_discovery_with_wmic/) | [Domain Groups](/tags/#domain-groups) | Hunting | -| [Domain Group Discovery with Adsisearcher](/endpoint/domain_group_discovery_with_adsisearcher/) | [Domain Groups](/tags/#domain-groups) | TTP | +| [Domain Group Discovery With Dsquery](/endpoint/domain_group_discovery_with_dsquery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | +| [Domain Group Discovery With Net](/endpoint/domain_group_discovery_with_net/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | +| [Domain Group Discovery With Wmic](/endpoint/domain_group_discovery_with_wmic/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | +| [Domain Group Discovery with Adsisearcher](/endpoint/domain_group_discovery_with_adsisearcher/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | | [Download Files Using Telegram](/endpoint/download_files_using_telegram/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | -| [Drop IcedID License dat](/endpoint/drop_icedid_license_dat/) | [Malicious File](/tags/#malicious-file) | Hunting | -| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Dump LSASS via procdump](/endpoint/dump_lsass_via_procdump/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Elevated Group Discovery With Net](/endpoint/elevated_group_discovery_with_net/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [Elevated Group Discovery With Wmic](/endpoint/elevated_group_discovery_with_wmic/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [Elevated Group Discovery with PowerView](/endpoint/elevated_group_discovery_with_powerview/) | [Domain Groups](/tags/#domain-groups) | Hunting | +| [Drop IcedID License dat](/endpoint/drop_icedid_license_dat/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | Hunting | +| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Dump LSASS via procdump](/endpoint/dump_lsass_via_procdump/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [ETW Registry Disabled](/endpoint/etw_registry_disabled/) | [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Elevated Group Discovery With Net](/endpoint/elevated_group_discovery_with_net/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [Elevated Group Discovery With Wmic](/endpoint/elevated_group_discovery_with_wmic/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [Elevated Group Discovery with PowerView](/endpoint/elevated_group_discovery_with_powerview/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | | [Email Attachments With Lots Of Spaces]() | None | Anomaly | -| [Email files written outside of the Outlook directory](/application/email_files_written_outside_of_the_outlook_directory/) | [Local Email Collection](/tags/#local-email-collection) | TTP | -| [Email servers sending high volume traffic to hosts](/application/email_servers_sending_high_volume_traffic_to_hosts/) | [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | +| [Email files written outside of the Outlook directory](/application/email_files_written_outside_of_the_outlook_directory/) | [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection) | TTP | +| [Email servers sending high volume traffic to hosts](/application/email_servers_sending_high_volume_traffic_to_hosts/) | [Email Collection](/tags/#email-collection), [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | | [Enable RDP In Other Port Number](/endpoint/enable_rdp_in_other_port_number/) | [Remote Services](/tags/#remote-services) | TTP | +| [Enable WDigest UseLogonCredential Registry](/endpoint/enable_wdigest_uselogoncredential_registry/) | [Modify Registry](/tags/#modify-registry), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Enumerate Users Local Group Using Telegram](/endpoint/enumerate_users_local_group_using_telegram/) | [Account Discovery](/tags/#account-discovery) | TTP | -| [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager) | Hunting | -| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [Excel Spawning PowerShell](/endpoint/excel_spawning_powershell/) | [Security Account Manager](/tags/#security-account-manager) | TTP | -| [Excel Spawning Windows Script Host](/endpoint/excel_spawning_windows_script_host/) | [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | Hunting | +| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Excel Spawning PowerShell](/endpoint/excel_spawning_powershell/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Excel Spawning Windows Script Host](/endpoint/excel_spawning_windows_script_host/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Excessive Attempt To Disable Services](/endpoint/excessive_attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | Anomaly | -| [Excessive DNS Failures](/network/excessive_dns_failures/) | [DNS](/tags/#dns) | Anomaly | +| [Excessive DNS Failures](/network/excessive_dns_failures/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol) | Anomaly | | [Excessive Service Stop Attempt](/endpoint/excessive_service_stop_attempt/) | [Service Stop](/tags/#service-stop) | Anomaly | | [Excessive Usage Of Cacls App](/endpoint/excessive_usage_of_cacls_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | Anomaly | | [Excessive Usage Of Net App](/endpoint/excessive_usage_of_net_app/) | [Account Access Removal](/tags/#account-access-removal) | Anomaly | -| [Excessive Usage Of SC Service Utility](/endpoint/excessive_usage_of_sc_service_utility/) | [Service Execution](/tags/#service-execution) | Anomaly | -| [Excessive Usage Of Taskkill](/endpoint/excessive_usage_of_taskkill/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | Anomaly | +| [Excessive Usage Of SC Service Utility](/endpoint/excessive_usage_of_sc_service_utility/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly | +| [Excessive Usage Of Taskkill](/endpoint/excessive_usage_of_taskkill/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | Anomaly | | [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | | [Excessive number of distinct processes created in Windows Temp folder](/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly | -| [Excessive number of service control start as disabled](/endpoint/excessive_number_of_service_control_start_as_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | Anomaly | +| [Excessive number of service control start as disabled](/endpoint/excessive_number_of_service_control_start_as_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | Anomaly | | [Excessive number of taskhost processes](/endpoint/excessive_number_of_taskhost_processes/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Anomaly | | [Exchange PowerShell Abuse via SSRF](/endpoint/exchange_powershell_abuse_via_ssrf/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | -| [Exchange PowerShell Module Usage](/endpoint/exchange_powershell_module_usage/) | [PowerShell](/tags/#powershell) | TTP | +| [Exchange PowerShell Module Usage](/endpoint/exchange_powershell_module_usage/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading) | TTP | -| [Execute Javascript With Jscript COM CLSID](/endpoint/execute_javascript_with_jscript_com_clsid/) | [Visual Basic](/tags/#visual-basic) | TTP | -| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | -| [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Execute Javascript With Jscript COM CLSID](/endpoint/execute_javascript_with_jscript_com_clsid/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic) | TTP | +| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [File with Samsam Extension]() | None | TTP | | [First Time Seen Child Process of Zoom](/endpoint/first_time_seen_child_process_of_zoom/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | Anomaly | -| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution) | Anomaly | +| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly | | [First time seen command line argument](/endpoint/first_time_seen_command_line_argument/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution) | Anomaly | -| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [Fsutil Zeroing File](/endpoint/fsutil_zeroing_file/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | | [GCP Detect gcploit framework](/cloud/gcp_detect_gcploit_framework/) | [Valid Accounts](/tags/#valid-accounts) | TTP | | [GCP Kubernetes cluster pod scan detection](/cloud/gcp_kubernetes_cluster_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | Hunting | | [GPUpdate with no Command Line Arguments with Network](/endpoint/gpupdate_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | TTP | -| [GSuite Email Suspicious Attachment](/cloud/gsuite_email_suspicious_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | +| [GSuite Email Suspicious Attachment](/cloud/gsuite_email_suspicious_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly | | [Get ADDefaultDomainPasswordPolicy with Powershell](/endpoint/get_addefaultdomainpasswordpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | Hunting | | [Get ADDefaultDomainPasswordPolicy with Powershell Script Block](/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | Hunting | -| [Get ADUser with PowerShell](/endpoint/get_aduser_with_powershell/) | [Domain Account](/tags/#domain-account) | Hunting | -| [Get ADUser with PowerShell Script Block](/endpoint/get_aduser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | Hunting | +| [Get ADUser with PowerShell](/endpoint/get_aduser_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | Hunting | +| [Get ADUser with PowerShell Script Block](/endpoint/get_aduser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | Hunting | | [Get ADUserResultantPasswordPolicy with Powershell](/endpoint/get_aduserresultantpasswordpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | | [Get ADUserResultantPasswordPolicy with Powershell Script Block](/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | | [Get DomainPolicy with Powershell](/endpoint/get_domainpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | | [Get DomainPolicy with Powershell Script Block](/endpoint/get_domainpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | -| [Get DomainUser with PowerShell](/endpoint/get_domainuser_with_powershell/) | [Domain Account](/tags/#domain-account) | TTP | -| [Get DomainUser with PowerShell Script Block](/endpoint/get_domainuser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | TTP | -| [Get WMIObject Group Discovery](/endpoint/get_wmiobject_group_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | -| [Get WMIObject Group Discovery with Script Block Logging](/endpoint/get_wmiobject_group_discovery_with_script_block_logging/) | [Local Groups](/tags/#local-groups) | Hunting | +| [Get DomainUser with PowerShell](/endpoint/get_domainuser_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | +| [Get DomainUser with PowerShell Script Block](/endpoint/get_domainuser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | +| [Get WMIObject Group Discovery](/endpoint/get_wmiobject_group_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | +| [Get WMIObject Group Discovery with Script Block Logging](/endpoint/get_wmiobject_group_discovery_with_script_block_logging/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | | [Get-DomainTrust with PowerShell](/endpoint/get-domaintrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [Get-DomainTrust with PowerShell Script Block](/endpoint/get-domaintrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [Get-ForestTrust with PowerShell](/endpoint/get-foresttrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [GetAdComputer with PowerShell](/endpoint/getadcomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | | [GetAdComputer with PowerShell Script Block](/endpoint/getadcomputer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | -| [GetAdGroup with PowerShell](/endpoint/getadgroup_with_powershell/) | [Domain Groups](/tags/#domain-groups) | Hunting | -| [GetAdGroup with PowerShell Script Block](/endpoint/getadgroup_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | Hunting | +| [GetAdGroup with PowerShell](/endpoint/getadgroup_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | +| [GetAdGroup with PowerShell Script Block](/endpoint/getadgroup_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | | [GetCurrent User with PowerShell](/endpoint/getcurrent_user_with_powershell/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | | [GetCurrent User with PowerShell Script Block](/endpoint/getcurrent_user_with_powershell_script_block/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | | [GetDomainComputer with PowerShell](/endpoint/getdomaincomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | | [GetDomainComputer with PowerShell Script Block](/endpoint/getdomaincomputer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | | [GetDomainController with PowerShell](/endpoint/getdomaincontroller_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | | [GetDomainController with PowerShell Script Block](/endpoint/getdomaincontroller_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | -| [GetDomainGroup with PowerShell](/endpoint/getdomaingroup_with_powershell/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [GetDomainGroup with PowerShell Script Block](/endpoint/getdomaingroup_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [GetLocalUser with PowerShell](/endpoint/getlocaluser_with_powershell/) | [Local Account](/tags/#local-account) | Hunting | -| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Local Account](/tags/#local-account) | Hunting | +| [GetDomainGroup with PowerShell](/endpoint/getdomaingroup_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [GetDomainGroup with PowerShell Script Block](/endpoint/getdomaingroup_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [GetLocalUser with PowerShell](/endpoint/getlocaluser_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | +| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | | [GetNetTcpconnection with PowerShell](/endpoint/getnettcpconnection_with_powershell/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | | [GetNetTcpconnection with PowerShell Script Block](/endpoint/getnettcpconnection_with_powershell_script_block/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | -| [GetWmiObject DS User with PowerShell](/endpoint/getwmiobject_ds_user_with_powershell/) | [Domain Account](/tags/#domain-account) | TTP | -| [GetWmiObject DS User with PowerShell Script Block](/endpoint/getwmiobject_ds_user_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | TTP | +| [GetWmiObject DS User with PowerShell](/endpoint/getwmiobject_ds_user_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | +| [GetWmiObject DS User with PowerShell Script Block](/endpoint/getwmiobject_ds_user_with_powershell_script_block/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | | [GetWmiObject Ds Computer with PowerShell](/endpoint/getwmiobject_ds_computer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | | [GetWmiObject Ds Computer with PowerShell Script Block](/endpoint/getwmiobject_ds_computer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | -| [GetWmiObject Ds Group with PowerShell](/endpoint/getwmiobject_ds_group_with_powershell/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [GetWmiObject Ds Group with PowerShell Script Block](/endpoint/getwmiobject_ds_group_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [GetWmiObject User Account with PowerShell](/endpoint/getwmiobject_user_account_with_powershell/) | [Local Account](/tags/#local-account) | Hunting | -| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Local Account](/tags/#local-account) | Hunting | -| [GitHub Dependabot Alert](/cloud/github_dependabot_alert/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools) | Anomaly | -| [GitHub Pull Request from Unknown User](/cloud/github_pull_request_from_unknown_user/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools) | Anomaly | +| [GetWmiObject Ds Group with PowerShell](/endpoint/getwmiobject_ds_group_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [GetWmiObject Ds Group with PowerShell Script Block](/endpoint/getwmiobject_ds_group_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [GetWmiObject User Account with PowerShell](/endpoint/getwmiobject_user_account_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | +| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | +| [GitHub Dependabot Alert](/cloud/github_dependabot_alert/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise) | Anomaly | +| [GitHub Pull Request from Unknown User](/cloud/github_pull_request_from_unknown_user/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise) | Anomaly | | [Github Commit Changes In Master](/cloud/github_commit_changes_in_master/) | [Trusted Relationship](/tags/#trusted-relationship) | Anomaly | | [Github Commit In Develop](/cloud/github_commit_in_develop/) | [Trusted Relationship](/tags/#trusted-relationship) | Anomaly | | [Grant Permission Using Cacls Utility](/endpoint/grant_permission_using_cacls_utility/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | -| [Gsuite Drive Share In External Email](/cloud/gsuite_drive_share_in_external_email/) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage) | Anomaly | -| [Gsuite Email Suspicious Subject With Attachment](/cloud/gsuite_email_suspicious_subject_with_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | -| [Gsuite Email With Known Abuse Web Service Link](/cloud/gsuite_email_with_known_abuse_web_service_link/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | -| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | -| [Gsuite Suspicious Shared File Name](/cloud/gsuite_suspicious_shared_file_name/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | -| [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP | +| [Gsuite Drive Share In External Email](/cloud/gsuite_drive_share_in_external_email/) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service) | Anomaly | +| [Gsuite Email Suspicious Subject With Attachment](/cloud/gsuite_email_suspicious_subject_with_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly | +| [Gsuite Email With Known Abuse Web Service Link](/cloud/gsuite_email_with_known_abuse_web_service_link/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly | +| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | +| [Gsuite Suspicious Shared File Name](/cloud/gsuite_suspicious_shared_file_name/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly | +| [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP | | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly | -| [High Number of Login Failures from a single source](/cloud/high_number_of_login_failures_from_a_single_source/) | [Password Guessing](/tags/#password-guessing) | Anomaly | +| [High Number of Login Failures from a single source](/cloud/high_number_of_login_failures_from_a_single_source/) | [Password Guessing](/tags/#password-guessing), [Brute Force](/tags/#brute-force) | Anomaly | | [High Process Termination Frequency](/endpoint/high_process_termination_frequency/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly | -| [Hosts receiving high volume of network traffic from email server](/network/hosts_receiving_high_volume_of_network_traffic_from_email_server/) | [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | +| [Hosts receiving high volume of network traffic from email server](/network/hosts_receiving_high_volume_of_network_traffic_from_email_server/) | [Remote Email Collection](/tags/#remote-email-collection), [Email Collection](/tags/#email-collection) | Anomaly | | [ICACLS Grant Command](/endpoint/icacls_grant_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | | [Icacls Deny Command](/endpoint/icacls_deny_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | -| [IcedID Exfiltrated Archived File Creation](/endpoint/icedid_exfiltrated_archived_file_creation/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | +| [IcedID Exfiltrated Archived File Creation](/endpoint/icedid_exfiltrated_archived_file_creation/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting | | [Illegal Access To User Content via PowerSploit modules](/endpoint/illegal_access_to_user_content_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking) | TTP | | [Illegal Account Creation via PowerSploit modules](/endpoint/illegal_account_creation_via_powersploit_modules/) | [Establish Accounts](/tags/#establish-accounts) | TTP | | [Illegal Deletion of Logs via Mimikatz modules](/endpoint/illegal_deletion_of_logs_via_mimikatz_modules/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | @@ -357,121 +363,126 @@ sidebar: | [Illegal Privilege Elevation via Mimikatz modules](/endpoint/illegal_privilege_elevation_via_mimikatz_modules/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [Illegal Service and Process Control via Mimikatz modules](/endpoint/illegal_service_and_process_control_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP | | [Illegal Service and Process Control via PowerSploit modules](/endpoint/illegal_service_and_process_control_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP | -| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [JavaScript](/tags/#javascript) | TTP | -| [Kerberoasting spn request with RC4 encryption](/endpoint/kerberoasting_spn_request_with_rc4_encryption/) | [Kerberoasting](/tags/#kerberoasting) | TTP | +| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | TTP | +| [Kerberoasting spn request with RC4 encryption](/endpoint/kerberoasting_spn_request_with_rc4_encryption/) | [Kerberoasting](/tags/#kerberoasting), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | | [Known Services Killed by Ransomware](/endpoint/known_services_killed_by_ransomware/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Kubernetes AWS detect suspicious kubectl calls]() | None | Hunting | | [Kubernetes Nginx Ingress LFI](/cloud/kubernetes_nginx_ingress_lfi/) | [Exploitation for Credential Access](/tags/#exploitation-for-credential-access) | TTP | | [Kubernetes Nginx Ingress RFI](/cloud/kubernetes_nginx_ingress_rfi/) | [Exploitation for Credential Access](/tags/#exploitation-for-credential-access) | TTP | | [Kubernetes Scanner Image Pulling](/cloud/kubernetes_scanner_image_pulling/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | TTP | -| [Large Volume of DNS ANY Queries](/network/large_volume_of_dns_any_queries/) | [Reflection Amplification](/tags/#reflection-amplification) | Anomaly | -| [Local Account Discovery With Wmic](/endpoint/local_account_discovery_with_wmic/) | [Local Account](/tags/#local-account) | Hunting | -| [Local Account Discovery with Net](/endpoint/local_account_discovery_with_net/) | [Local Account](/tags/#local-account) | Hunting | -| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [JavaScript](/tags/#javascript) | Anomaly | -| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [JavaScript](/tags/#javascript) | Anomaly | -| [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Large Volume of DNS ANY Queries](/network/large_volume_of_dns_any_queries/) | [Network Denial of Service](/tags/#network-denial-of-service), [Reflection Amplification](/tags/#reflection-amplification) | Anomaly | +| [Local Account Discovery With Wmic](/endpoint/local_account_discovery_with_wmic/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | +| [Local Account Discovery with Net](/endpoint/local_account_discovery_with_net/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | +| [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP | +| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | Anomaly | +| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | Anomaly | +| [MSBuild Suspicious Spawned By Script Process](/endpoint/msbuild_suspicious_spawned_by_script_process/) | [MSBuild](/tags/#msbuild), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP | +| [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | | [MacOS - Re-opened Applications]() | None | TTP | -| [Mailsniper Invoke functions](/endpoint/mailsniper_invoke_functions/) | [Local Email Collection](/tags/#local-email-collection) | TTP | -| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell) | Hunting | +| [Mailsniper Invoke functions](/endpoint/mailsniper_invoke_functions/) | [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection) | TTP | +| [Malicious InProcServer32 Modification](/endpoint/malicious_inprocserver32_modification/) | [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry) | TTP | +| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Hunting | | [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | Hunting | -| [Malicious PowerShell Process - Execution Policy Bypass](/endpoint/malicious_powershell_process_-_execution_policy_bypass/) | [PowerShell](/tags/#powershell) | TTP | -| [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [PowerShell](/tags/#powershell) | TTP | -| [Malicious Powershell Executed As A Service](/endpoint/malicious_powershell_executed_as_a_service/) | [Service Execution](/tags/#service-execution) | TTP | +| [Malicious PowerShell Process - Execution Policy Bypass](/endpoint/malicious_powershell_process_-_execution_policy_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [Malicious Powershell Executed As A Service](/endpoint/malicious_powershell_executed_as_a_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | TTP | | [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | TTP | | [Modify ACL permission To Files Or Folder](/endpoint/modify_acl_permission_to_files_or_folder/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | | [Modify ACLs Permission Of Files Or Folders](/endpoint/modify_acls_permission_of_files_or_folders/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | Anomaly | | [Monitor Email For Brand Abuse]() | None | TTP | -| [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors) | TTP | +| [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Monitor Web Traffic For Brand Abuse]() | None | TTP | | [More than usual number of LOLBAS applications in short time period](/endpoint/more_than_usual_number_of_lolbas_applications_in_short_time_period/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly | -| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Mshta](/tags/#mshta) | TTP | -| [Msmpeng Application DLL Side Loading](/endpoint/msmpeng_application_dll_side_loading/) | [DLL Side-Loading](/tags/#dll-side-loading) | TTP | -| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | TTP | -| [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Okta Users With Invalid Credentials From The Same IP](/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip/) | [Default Accounts](/tags/#default-accounts) | TTP | -| [Multiple Users Attempting To Authenticate Using Explicit Credentials](/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Users Remotely Failing To Authenticate From Host](/endpoint/multiple_users_remotely_failing_to_authenticate_from_host/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [Msmpeng Application DLL Side Loading](/endpoint/msmpeng_application_dll_side_loading/) | [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | +| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | +| [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Okta Users With Invalid Credentials From The Same IP](/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip/) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | TTP | +| [Multiple Users Attempting To Authenticate Using Explicit Credentials](/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Users Remotely Failing To Authenticate From Host](/endpoint/multiple_users_remotely_failing_to_authenticate_from_host/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | -| [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | +| [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | | [Network Connection Discovery With Arp](/endpoint/network_connection_discovery_with_arp/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | | [Network Connection Discovery With Net](/endpoint/network_connection_discovery_with_net/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | | [Network Connection Discovery With Netstat](/endpoint/network_connection_discovery_with_netstat/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | | [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Internal Image](/tags/#implant-internal-image) | Hunting | -| [Nishang PowershellTCPOneLine](/endpoint/nishang_powershelltcponeline/) | [PowerShell](/tags/#powershell) | TTP | +| [Nishang PowershellTCPOneLine](/endpoint/nishang_powershelltcponeline/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [No Windows Updates in a time frame]() | None | Hunting | -| [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly | -| [Non Firefox Process Access Firefox Profile Dir](/endpoint/non_firefox_process_access_firefox_profile_dir/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly | -| [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds) | TTP | -| [O365 Add App Role Assignment Grant User](/cloud/o365_add_app_role_assignment_grant_user/) | [Cloud Account](/tags/#cloud-account) | TTP | -| [O365 Added Service Principal](/cloud/o365_added_service_principal/) | [Cloud Account](/tags/#cloud-account) | TTP | -| [O365 Bypass MFA via Trusted IP](/cloud/o365_bypass_mfa_via_trusted_ip/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | +| [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly | +| [Non Firefox Process Access Firefox Profile Dir](/endpoint/non_firefox_process_access_firefox_profile_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly | +| [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [O365 Add App Role Assignment Grant User](/cloud/o365_add_app_role_assignment_grant_user/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | +| [O365 Added Service Principal](/cloud/o365_added_service_principal/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | +| [O365 Bypass MFA via Trusted IP](/cloud/o365_bypass_mfa_via_trusted_ip/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | | [O365 Disable MFA](/cloud/o365_disable_mfa/) | [Modify Authentication Process](/tags/#modify-authentication-process) | TTP | | [O365 Excessive Authentication Failures Alert](/cloud/o365_excessive_authentication_failures_alert/) | [Brute Force](/tags/#brute-force) | Anomaly | | [O365 Excessive SSO logon errors](/cloud/o365_excessive_sso_logon_errors/) | [Modify Authentication Process](/tags/#modify-authentication-process) | Anomaly | -| [O365 New Federated Domain Added](/cloud/o365_new_federated_domain_added/) | [Cloud Account](/tags/#cloud-account) | TTP | +| [O365 New Federated Domain Added](/cloud/o365_new_federated_domain_added/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | | [O365 PST export alert](/cloud/o365_pst_export_alert/) | [Email Collection](/tags/#email-collection) | TTP | -| [O365 Suspicious Admin Email Forwarding](/cloud/o365_suspicious_admin_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | Anomaly | -| [O365 Suspicious Rights Delegation](/cloud/o365_suspicious_rights_delegation/) | [Remote Email Collection](/tags/#remote-email-collection) | TTP | -| [O365 Suspicious User Email Forwarding](/cloud/o365_suspicious_user_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | Anomaly | -| [Office Application Drop Executable](/endpoint/office_application_drop_executable/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Application Spawn Regsvr32 process](/endpoint/office_application_spawn_regsvr32_process/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Document Creating Schedule Task](/endpoint/office_document_creating_schedule_task/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Document Spawned Child Process To Download](/endpoint/office_document_spawned_child_process_to_download/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawn CMD Process](/endpoint/office_product_spawn_cmd_process/) | [Mshta](/tags/#mshta) | TTP | -| [Office Product Spawning BITSAdmin](/endpoint/office_product_spawning_bitsadmin/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawning CertUtil](/endpoint/office_product_spawning_certutil/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawning MSHTA](/endpoint/office_product_spawning_mshta/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawning Rundll32 with no DLL](/endpoint/office_product_spawning_rundll32_with_no_dll/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawning Wmic](/endpoint/office_product_spawning_wmic/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Writing cab or inf](/endpoint/office_product_writing_cab_or_inf/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Spawning Control](/endpoint/office_spawning_control/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Okta Account Lockout Events](/application/okta_account_lockout_events/) | [Default Accounts](/tags/#default-accounts) | Anomaly | -| [Okta Failed SSO Attempts](/application/okta_failed_sso_attempts/) | [Default Accounts](/tags/#default-accounts) | Anomaly | -| [Okta User Logins From Multiple Cities](/application/okta_user_logins_from_multiple_cities/) | [Default Accounts](/tags/#default-accounts) | Anomaly | -| [Overwriting Accessibility Binaries](/endpoint/overwriting_accessibility_binaries/) | [Accessibility Features](/tags/#accessibility-features) | TTP | +| [O365 Suspicious Admin Email Forwarding](/cloud/o365_suspicious_admin_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule), [Email Collection](/tags/#email-collection) | Anomaly | +| [O365 Suspicious Rights Delegation](/cloud/o365_suspicious_rights_delegation/) | [Remote Email Collection](/tags/#remote-email-collection), [Email Collection](/tags/#email-collection) | TTP | +| [O365 Suspicious User Email Forwarding](/cloud/o365_suspicious_user_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule), [Email Collection](/tags/#email-collection) | Anomaly | +| [Office Application Drop Executable](/endpoint/office_application_drop_executable/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Application Spawn Regsvr32 process](/endpoint/office_application_spawn_regsvr32_process/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Document Creating Schedule Task](/endpoint/office_document_creating_schedule_task/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Document Spawned Child Process To Download](/endpoint/office_document_spawned_child_process_to_download/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawn CMD Process](/endpoint/office_product_spawn_cmd_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [Office Product Spawning BITSAdmin](/endpoint/office_product_spawning_bitsadmin/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning CertUtil](/endpoint/office_product_spawning_certutil/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning MSHTA](/endpoint/office_product_spawning_mshta/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning Rundll32 with no DLL](/endpoint/office_product_spawning_rundll32_with_no_dll/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning Wmic](/endpoint/office_product_spawning_wmic/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Writing cab or inf](/endpoint/office_product_writing_cab_or_inf/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Spawning Control](/endpoint/office_spawning_control/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Okta Account Lockout Events](/application/okta_account_lockout_events/) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | Anomaly | +| [Okta Failed SSO Attempts](/application/okta_failed_sso_attempts/) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | Anomaly | +| [Okta User Logins From Multiple Cities](/application/okta_user_logins_from_multiple_cities/) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | Anomaly | +| [Overwriting Accessibility Binaries](/endpoint/overwriting_accessibility_binaries/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Accessibility Features](/tags/#accessibility-features) | TTP | | [Password Policy Discovery with Net](/endpoint/password_policy_discovery_with_net/) | [Password Policy Discovery](/tags/#password-policy-discovery) | Hunting | | [Permission Modification using Takeown App](/endpoint/permission_modification_using_takeown_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | | [PetitPotam Network Share Access Request](/endpoint/petitpotam_network_share_access_request/) | [Forced Authentication](/tags/#forced-authentication) | TTP | | [PetitPotam Suspicious Kerberos TGT Request](/endpoint/petitpotam_suspicious_kerberos_tgt_request/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Phishing Email Detection by Machine Learning Method - SSA](/application/phishing_email_detection_by_machine_learning_method_-_ssa/) | [Phishing](/tags/#phishing) | Anomaly | -| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | TTP | -| [Potential Pass the Token or Hash Observed at the Destination Device](/endpoint/potential_pass_the_token_or_hash_observed_at_the_destination_device/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | -| [Potential Pass the Token or Hash Observed by an Event Collecting Device](/endpoint/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | -| [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [PowerShell](/tags/#powershell) | Hunting | -| [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [PowerShell](/tags/#powershell) | TTP | -| [PowerShell Get LocalGroup Discovery](/endpoint/powershell_get_localgroup_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | -| [PowerShell Loading DotNET into Memory via System Reflection Assembly](/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly/) | [PowerShell](/tags/#powershell) | TTP | +| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | +| [Potential Pass the Token or Hash Observed at the Destination Device](/endpoint/potential_pass_the_token_or_hash_observed_at_the_destination_device/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [Potential Pass the Token or Hash Observed by an Event Collecting Device](/endpoint/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | Hunting | +| [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [PowerShell Get LocalGroup Discovery](/endpoint/powershell_get_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | +| [PowerShell Loading DotNET into Memory via System Reflection Assembly](/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [PowerShell Start-BitsTransfer](/endpoint/powershell_start-bitstransfer/) | [BITS Jobs](/tags/#bits-jobs) | TTP | -| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | -| [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | -| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking) | TTP | -| [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell) | TTP | -| [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell) | TTP | -| [Powershell Get LocalGroup Discovery with Script Block Logging](/endpoint/powershell_get_localgroup_discovery_with_script_block_logging/) | [Local Groups](/tags/#local-groups) | Hunting | -| [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [PowerShell](/tags/#powershell) | TTP | +| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | +| [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | +| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell) | TTP | +| [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell) | TTP | +| [Powershell Get LocalGroup Discovery with Script Block Logging](/endpoint/powershell_get_localgroup_discovery_with_script_block_logging/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | +| [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [Powershell Remote Thread To Known Windows Process](/endpoint/powershell_remote_thread_to_known_windows_process/) | [Process Injection](/tags/#process-injection) | TTP | | [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | TTP | | [Prevent Automatic Repair Mode using Bcdedit](/endpoint/prevent_automatic_repair_mode_using_bcdedit/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | -| [Print Spooler Adding A Printer Driver](/endpoint/print_spooler_adding_a_printer_driver/) | [Print Processors](/tags/#print-processors) | TTP | -| [Print Spooler Failed to Load a Plug-in](/endpoint/print_spooler_failed_to_load_a_plug-in/) | [Print Processors](/tags/#print-processors) | TTP | +| [Print Processor Registry Autostart](/endpoint/print_processor_registry_autostart/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Print Spooler Adding A Printer Driver](/endpoint/print_spooler_adding_a_printer_driver/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Print Spooler Failed to Load a Plug-in](/endpoint/print_spooler_failed_to_load_a_plug-in/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Probing Access with Stolen Credentials via PowerSploit modules](/endpoint/probing_access_with_stolen_credentials_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | -| [Process Creating LNK file in Suspicious Location](/endpoint/process_creating_lnk_file_in_suspicious_location/) | [Spearphishing Link](/tags/#spearphishing-link) | TTP | +| [Process Creating LNK file in Suspicious Location](/endpoint/process_creating_lnk_file_in_suspicious_location/) | [Phishing](/tags/#phishing), [Spearphishing Link](/tags/#spearphishing-link) | TTP | | [Process Deleting Its Process File Path](/endpoint/process_deleting_its_process_file_path/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | | [Process Execution via WMI](/endpoint/process_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | -| [Process Kill Base On File Path](/endpoint/process_kill_base_on_file_path/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Process Kill Base On File Path](/endpoint/process_kill_base_on_file_path/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Process Writing DynamicWrapperX](/endpoint/process_writing_dynamicwrapperx/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Component Object Model](/tags/#component-object-model) | Hunting | | [Processes Tapping Keyboard Events]() | None | TTP | -| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | TTP | +| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Prohibited Network Traffic Allowed](/network/prohibited_network_traffic_allowed/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | -| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | +| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | | [Protocols passing authentication in cleartext]() | None | TTP | | [Ransomware Notes bulk creation](/endpoint/ransomware_notes_bulk_creation/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly | | [Rare Parent-Child Process Relationship](/endpoint/rare_parent-child_process_relationship/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job), [Software Deployment Tools](/tags/#software-deployment-tools) | Anomaly | @@ -482,26 +493,27 @@ sidebar: | [Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules](/endpoint/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules/) | [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning) | TTP | | [Reconnaissance and Access to Computers and Domains via PowerSploit modules](/endpoint/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Account Discovery](/tags/#account-discovery) | TTP | | [Reconnaissance and Access to Computers via Mimikatz modules](/endpoint/reconnaissance_and_access_to_computers_via_mimikatz_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP | -| [Reconnaissance and Access to Operating System Elements via PowerSploit modules](/endpoint/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules/) | [System Service Discovery](/tags/#system-service-discovery), [Query Registry](/tags/#query-registry), [Network Service Scanning](/tags/#network-service-scanning), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software Discovery](/tags/#software-discovery), [Software](/tags/#software) | TTP | +| [Reconnaissance and Access to Operating System Elements via PowerSploit modules](/endpoint/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules/) | [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software](/tags/#software), [Network Service Scanning](/tags/#network-service-scanning), [Query Registry](/tags/#query-registry), [System Service Discovery](/tags/#system-service-discovery), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Software Discovery](/tags/#software-discovery) | TTP | | [Reconnaissance and Access to Processes and Services via Mimikatz modules](/endpoint/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules/) | [System Service Discovery](/tags/#system-service-discovery), [Network Service Scanning](/tags/#network-service-scanning), [Process Discovery](/tags/#process-discovery) | TTP | -| [Reconnaissance and Access to Shared Resources via Mimikatz modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | TTP | -| [Reconnaissance and Access to Shared Resources via PowerSploit modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_powersploit_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | TTP | +| [Reconnaissance and Access to Shared Resources via Mimikatz modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Reconnaissance and Access to Shared Resources via PowerSploit modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | | [Reconnaissance of Access and Persistence Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | -| [Reconnaissance of Connectivity via PowerSploit modules](/endpoint/reconnaissance_of_connectivity_via_powersploit_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | TTP | -| [Reconnaissance of Credential Stores and Services via Mimikatz modules](/endpoint/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules/) | [Credentials](/tags/#credentials), [Domain Properties](/tags/#domain-properties), [Network Trust Dependencies](/tags/#network-trust-dependencies), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | -| [Reconnaissance of Defensive Tools via PowerSploit modules](/endpoint/reconnaissance_of_defensive_tools_via_powersploit_modules/) | [Vulnerability Scanning](/tags/#vulnerability-scanning), [Software](/tags/#software) | TTP | +| [Reconnaissance of Connectivity via PowerSploit modules](/endpoint/reconnaissance_of_connectivity_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Reconnaissance of Credential Stores and Services via Mimikatz modules](/endpoint/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules/) | [Account Manipulation](/tags/#account-manipulation), [Domain Properties](/tags/#domain-properties), [Valid Accounts](/tags/#valid-accounts), [Credentials](/tags/#credentials), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Gather Victim Identity Information](/tags/#gather-victim-identity-information), [Network Trust Dependencies](/tags/#network-trust-dependencies) | TTP | +| [Reconnaissance of Defensive Tools via PowerSploit modules](/endpoint/reconnaissance_of_defensive_tools_via_powersploit_modules/) | [Software](/tags/#software), [Vulnerability Scanning](/tags/#vulnerability-scanning), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Active Scanning](/tags/#active-scanning) | TTP | | [Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | | [Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules](/endpoint/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | -| [Recursive Delete of Directory In Batch CMD](/endpoint/recursive_delete_of_directory_in_batch_cmd/) | [File Deletion](/tags/#file-deletion) | TTP | -| [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | TTP | -| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | -| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | TTP | -| [Registry Keys for Creating SHIM Databases](/endpoint/registry_keys_for_creating_shim_databases/) | [Application Shimming](/tags/#application-shimming) | TTP | +| [Recursive Delete of Directory In Batch CMD](/endpoint/recursive_delete_of_directory_in_batch_cmd/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | +| [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | +| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Registry Keys for Creating SHIM Databases](/endpoint/registry_keys_for_creating_shim_databases/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Regsvr32 Silent Param Dll Loading](/endpoint/regsvr32_silent_param_dll_loading/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | TTP | | [Remcos RAT File Creation in Remcos Folder](/endpoint/remcos_rat_file_creation_in_remcos_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | | [Remcos client registry install entry](/endpoint/remcos_client_registry_install_entry/) | [Modify Registry](/tags/#modify-registry) | TTP | -| [Remote Desktop Network Bruteforce](/network/remote_desktop_network_bruteforce/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | -| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | Anomaly | -| [Remote Desktop Process Running On System](/endpoint/remote_desktop_process_running_on_system/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | Hunting | +| [Remote Desktop Network Bruteforce](/network/remote_desktop_network_bruteforce/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | TTP | +| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | Anomaly | +| [Remote Desktop Process Running On System](/endpoint/remote_desktop_process_running_on_system/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | Hunting | | [Remote Process Instantiation via WMI](/endpoint/remote_process_instantiation_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | | [Remote System Discovery with Adsisearcher](/endpoint/remote_system_discovery_with_adsisearcher/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | | [Remote System Discovery with Dsquery](/endpoint/remote_system_discovery_with_dsquery/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | @@ -512,101 +524,106 @@ sidebar: | [Resize Shadowstorage Volume](/endpoint/resize_shadowstorage_volume/) | [Service Stop](/tags/#service-stop) | TTP | | [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP | | [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry) | TTP | -| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Rundll32](/tags/#rundll32) | TTP | -| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Rundll32](/tags/#rundll32) | Hunting | -| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Rundll32](/tags/#rundll32) | TTP | +| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | Hunting | +| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Rundll32 Create Remote Thread To A Process](/endpoint/rundll32_create_remote_thread_to_a_process/) | [Process Injection](/tags/#process-injection) | TTP | | [Rundll32 CreateRemoteThread In Browser](/endpoint/rundll32_createremotethread_in_browser/) | [Process Injection](/tags/#process-injection) | TTP | -| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [Rundll32](/tags/#rundll32) | TTP | -| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [Rundll32](/tags/#rundll32) | TTP | -| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 Shimcache Flush](/endpoint/rundll32_shimcache_flush/) | [Modify Registry](/tags/#modify-registry) | TTP | +| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Ryuk Test Files Detected](/endpoint/ryuk_test_files_detected/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | TTP | -| [Ryuk Wake on LAN Command](/endpoint/ryuk_wake_on_lan_command/) | [Windows Command Shell](/tags/#windows-command-shell) | TTP | -| [SAM Database File Access Attempt](/endpoint/sam_database_file_access_attempt/) | [Security Account Manager](/tags/#security-account-manager) | Hunting | -| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | -| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | +| [Ryuk Wake on LAN Command](/endpoint/ryuk_wake_on_lan_command/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | TTP | +| [SAM Database File Access Attempt](/endpoint/sam_database_file_access_attempt/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | Hunting | +| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly | +| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly | | [SQL Injection with Long URLs](/web/sql_injection_with_long_urls/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | | [Samsam Test File Write](/endpoint/samsam_test_file_write/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | TTP | -| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | TTP | -| [SchCache Change By App Connect And Create ADSI Object](/endpoint/schcache_change_by_app_connect_and_create_adsi_object/) | [Domain Account](/tags/#domain-account) | Anomaly | +| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [SchCache Change By App Connect And Create ADSI Object](/endpoint/schcache_change_by_app_connect_and_create_adsi_object/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | Anomaly | | [Schedule Task with HTTP Command Arguments](/endpoint/schedule_task_with_http_command_arguments/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | | [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | -| [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | | [Schtasks Run Task On Demand](/endpoint/schtasks_run_task_on_demand/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | -| [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task) | TTP | -| [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [Screensaver Event Trigger Execution](/endpoint/screensaver_event_trigger_execution/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Screensaver](/tags/#screensaver) | TTP | | [Script Execution via WMI](/endpoint/script_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | -| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Sdelete Application Execution](/endpoint/sdelete_application_execution/) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | | [SearchProtocolHost with no Command Line with Network](/endpoint/searchprotocolhost_with_no_command_line_with_network/) | [Process Injection](/tags/#process-injection) | TTP | -| [SecretDumps Offline NTDS Dumping Tool](/endpoint/secretdumps_offline_ntds_dumping_tool/) | [NTDS](/tags/#ntds) | TTP | +| [SecretDumps Offline NTDS Dumping Tool](/endpoint/secretdumps_offline_ntds_dumping_tool/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Services Escalate Exe](/endpoint/services_escalate_exe/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | -| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [PowerShell](/tags/#powershell) | TTP | +| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [Setting Credentials via DSInternals modules](/endpoint/setting_credentials_via_dsinternals_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | | [Setting Credentials via Mimikatz modules](/endpoint/setting_credentials_via_mimikatz_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | | [Setting Credentials via PowerSploit modules](/endpoint/setting_credentials_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | -| [Shim Database File Creation](/endpoint/shim_database_file_creation/) | [Application Shimming](/tags/#application-shimming) | TTP | -| [Shim Database Installation With Suspicious Parameters](/endpoint/shim_database_installation_with_suspicious_parameters/) | [Application Shimming](/tags/#application-shimming) | TTP | -| [Short Lived Windows Accounts](/endpoint/short_lived_windows_accounts/) | [Local Account](/tags/#local-account) | TTP | -| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [Malicious File](/tags/#malicious-file) | TTP | +| [Shim Database File Creation](/endpoint/shim_database_file_creation/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Shim Database Installation With Suspicious Parameters](/endpoint/shim_database_installation_with_suspicious_parameters/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Short Lived Windows Accounts](/endpoint/short_lived_windows_accounts/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | TTP | +| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | TTP | | [Spike in File Writes]() | None | Anomaly | -| [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors) | TTP | -| [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors) | TTP | +| [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Spoolsv Suspicious Process Access](/endpoint/spoolsv_suspicious_process_access/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | -| [Spoolsv Writing a DLL](/endpoint/spoolsv_writing_a_dll/) | [Print Processors](/tags/#print-processors) | TTP | -| [Spoolsv Writing a DLL - Sysmon](/endpoint/spoolsv_writing_a_dll_-_sysmon/) | [Print Processors](/tags/#print-processors) | TTP | +| [Spoolsv Writing a DLL](/endpoint/spoolsv_writing_a_dll/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Spoolsv Writing a DLL - Sysmon](/endpoint/spoolsv_writing_a_dll_-_sysmon/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Sqlite Module In Temp Folder](/endpoint/sqlite_module_in_temp_folder/) | [Data from Local System](/tags/#data-from-local-system) | TTP | -| [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | +| [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Sunburst Correlation DLL and Network Event](/endpoint/sunburst_correlation_dll_and_network_event/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | TTP | | [Supernova Webshell](/web/supernova_webshell/) | [Web Shell](/tags/#web-shell) | TTP | +| [Suspicious Copy on System32](/endpoint/suspicious_copy_on_system32/) | [Rename System Utilities](/tags/#rename-system-utilities), [Masquerading](/tags/#masquerading) | TTP | | [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [Suspicious DLLHost no Command Line Arguments](/endpoint/suspicious_dllhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | -| [Suspicious Driver Loaded Path](/endpoint/suspicious_driver_loaded_path/) | [Windows Service](/tags/#windows-service) | TTP | -| [Suspicious Email Attachment Extensions](/application/suspicious_email_attachment_extensions/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | -| [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Suspicious Driver Loaded Path](/endpoint/suspicious_driver_loaded_path/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [Suspicious Email Attachment Extensions](/application/suspicious_email_attachment_extensions/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly | +| [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | | [Suspicious GPUpdate no Command Line Arguments](/endpoint/suspicious_gpupdate_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | -| [Suspicious IcedID Regsvr32 Cmdline](/endpoint/suspicious_icedid_regsvr32_cmdline/) | [Regsvr32](/tags/#regsvr32) | TTP | -| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious IcedID Regsvr32 Cmdline](/endpoint/suspicious_icedid_regsvr32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | TTP | +| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | | [Suspicious Java Classes]() | None | Anomaly | -| [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | -| [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [MSBuild](/tags/#msbuild) | TTP | -| [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent) | TTP | -| [Suspicious PlistBuddy Usage via OSquery](/endpoint/suspicious_plistbuddy_usage_via_osquery/) | [Launch Agent](/tags/#launch-agent) | TTP | +| [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP | +| [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild) | TTP | +| [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [Suspicious PlistBuddy Usage via OSquery](/endpoint/suspicious_plistbuddy_usage_via_osquery/) | [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry) | TTP | -| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [Regsvr32](/tags/#regsvr32) | TTP | -| [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [Rundll32](/tags/#rundll32) | TTP | -| [Suspicious Rundll32 Rename](/endpoint/suspicious_rundll32_rename/) | [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | -| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Rundll32](/tags/#rundll32) | TTP | -| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [Rundll32](/tags/#rundll32) | TTP | -| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | TTP | +| [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 Rename](/endpoint/suspicious_rundll32_rename/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Suspicious SQLite3 LSQuarantine Behavior](/endpoint/suspicious_sqlite3_lsquarantine_behavior/) | [Data Staged](/tags/#data-staged) | TTP | -| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task) | Anomaly | +| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly | | [Suspicious SearchProtocolHost no Command Line Arguments](/endpoint/suspicious_searchprotocolhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | | [Suspicious WAV file in Appdata Folder](/endpoint/suspicious_wav_file_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | -| [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | | [Suspicious microsoft workflow compiler usage](/endpoint/suspicious_microsoft_workflow_compiler_usage/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP | -| [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | -| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [Mshta](/tags/#mshta) | TTP | -| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [Mshta](/tags/#mshta) | TTP | -| [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP | +| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | | [Suspicious writes to windows Recycle Bin](/endpoint/suspicious_writes_to_windows_recycle_bin/) | [Masquerading](/tags/#masquerading) | TTP | | [System Information Discovery Detection](/endpoint/system_information_discovery_detection/) | [System Information Discovery](/tags/#system-information-discovery) | TTP | | [System Process Running from Unexpected Location](/endpoint/system_process_running_from_unexpected_location/) | [Masquerading](/tags/#masquerading) | Anomaly | -| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | | [System User Discovery With Query](/endpoint/system_user_discovery_with_query/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | | [System User Discovery With Whoami](/endpoint/system_user_discovery_with_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | -| [TOR Traffic](/network/tor_traffic/) | [Web Protocols](/tags/#web-protocols) | TTP | +| [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | TTP | +| [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Trickbot Named Pipe](/endpoint/trickbot_named_pipe/) | [Process Injection](/tags/#process-injection) | TTP | -| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [CMSTP](/tags/#cmstp) | TTP | +| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP | | [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | | [Unified Messaging Service Spawning a Process](/endpoint/unified_messaging_service_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | -| [Uninstall App Using MsiExec](/endpoint/uninstall_app_using_msiexec/) | [Msiexec](/tags/#msiexec) | TTP | -| [Unload Sysmon Filter Driver](/endpoint/unload_sysmon_filter_driver/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Uninstall App Using MsiExec](/endpoint/uninstall_app_using_msiexec/) | [Msiexec](/tags/#msiexec), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP | +| [Unload Sysmon Filter Driver](/endpoint/unload_sysmon_filter_driver/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses) | TTP | | [Unusually Long Command Line]() | None | Anomaly | | [Unusually Long Command Line]() | None | Anomaly | @@ -614,33 +631,37 @@ sidebar: | [Unusually Long Content-Type Length]() | None | Anomaly | | [User Discovery With Env Vars PowerShell](/endpoint/user_discovery_with_env_vars_powershell/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | | [User Discovery With Env Vars PowerShell Script Block](/endpoint/user_discovery_with_env_vars_powershell_script_block/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | -| [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Web Shell](/tags/#web-shell) | TTP | +| [Vbscript Execution Using Wscript App](/endpoint/vbscript_execution_using_wscript_app/) | [Visual Basic](/tags/#visual-basic), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | +| [Verclsid CLSID Execution](/endpoint/verclsid_clsid_execution/) | [Verclsid](/tags/#verclsid), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | Hunting | +| [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | TTP | | [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [WMI Permanent Event Subscription](/endpoint/wmi_permanent_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | -| [WMI Permanent Event Subscription - Sysmon](/endpoint/wmi_permanent_event_subscription_-_sysmon/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription) | TTP | +| [WMI Permanent Event Subscription - Sysmon](/endpoint/wmi_permanent_event_subscription_-_sysmon/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | | [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP | | [WMI Temporary Event Subscription](/endpoint/wmi_temporary_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | -| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [CMSTP](/tags/#cmstp) | TTP | +| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP | | [Web Servers Executing Suspicious Processes](/application/web_servers_executing_suspicious_processes/) | [System Information Discovery](/tags/#system-information-discovery) | TTP | -| [Wermgr Process Connecting To IP Check Web Services](/endpoint/wermgr_process_connecting_to_ip_check_web_services/) | [IP Addresses](/tags/#ip-addresses) | TTP | +| [Wermgr Process Connecting To IP Check Web Services](/endpoint/wermgr_process_connecting_to_ip_check_web_services/) | [Gather Victim Network Information](/tags/#gather-victim-network-information), [IP Addresses](/tags/#ip-addresses) | TTP | | [Wermgr Process Create Executable File](/endpoint/wermgr_process_create_executable_file/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | TTP | | [Wermgr Process Spawned CMD Or Powershell Process](/endpoint/wermgr_process_spawned_cmd_or_powershell_process/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | -| [WevtUtil Usage To Clear Logs](/endpoint/wevtutil_usage_to_clear_logs/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [Wevtutil Usage To Disable Logs](/endpoint/wevtutil_usage_to_disable_logs/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task) | TTP | -| [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [WevtUtil Usage To Clear Logs](/endpoint/wevtutil_usage_to_clear_logs/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Wevtutil Usage To Disable Logs](/endpoint/wevtutil_usage_to_disable_logs/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | | [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | | [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | -| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | | [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | TTP | -| [Winword Spawning Cmd](/endpoint/winword_spawning_cmd/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Winword Spawning PowerShell](/endpoint/winword_spawning_powershell/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Winword Spawning Windows Script Host](/endpoint/winword_spawning_windows_script_host/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Wmic Group Discovery](/endpoint/wmic_group_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | -| [Write Executable in SMB Share](/endpoint/write_executable_in_smb_share/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | -| [XMRIG Driver Loaded](/endpoint/xmrig_driver_loaded/) | [Windows Service](/tags/#windows-service) | TTP | +| [Winhlp32 Spawning a Process](/endpoint/winhlp32_spawning_a_process/) | [Process Injection](/tags/#process-injection) | TTP | +| [Winword Spawning Cmd](/endpoint/winword_spawning_cmd/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Winword Spawning PowerShell](/endpoint/winword_spawning_powershell/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Winword Spawning Windows Script Host](/endpoint/winword_spawning_windows_script_host/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Wmic Group Discovery](/endpoint/wmic_group_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | +| [Write Executable in SMB Share](/endpoint/write_executable_in_smb_share/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Wscript Or Cscript Suspicious Child Process](/endpoint/wscript_or_cscript_suspicious_child_process/) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | TTP | +| [XMRIG Driver Loaded](/endpoint/xmrig_driver_loaded/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [XSL Script Execution With WMIC](/endpoint/xsl_script_execution_with_wmic/) | [XSL Script Processing](/tags/#xsl-script-processing) | TTP | | [aws detect attach to role policy](/cloud/aws_detect_attach_to_role_policy/) | [Valid Accounts](/tags/#valid-accounts) | Hunting | | [aws detect permanent key creation](/cloud/aws_detect_permanent_key_creation/) | [Valid Accounts](/tags/#valid-accounts) | Hunting | diff --git a/docs/_pages/lateral_movement.md b/docs/_pages/lateral_movement.md index 42acf4eb27..e9de2d6344 100644 --- a/docs/_pages/lateral_movement.md +++ b/docs/_pages/lateral_movement.md @@ -10,4 +10,4 @@ sidebar: | Name | Technique | Tactic | | ----------- | ----------- |--------------| -| [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file +| [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file diff --git a/docs/_pages/malware.md b/docs/_pages/malware.md index db8e2eae05..2737b240fa 100644 --- a/docs/_pages/malware.md +++ b/docs/_pages/malware.md @@ -11,24 +11,24 @@ sidebar: | Name | Technique | Tactic | | ----------- | ----------- |--------------| | [BlackMatter Ransomware](/stories/blackmatter_ransomware/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | -| [Clop Ransomware](/stories/clop_ransomware/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | +| [Clop Ransomware](/stories/clop_ransomware/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | | [ColdRoot MacOS RAT]() | None | None | | [DHS Report TA18-074A](/stories/dhs_report_ta18-074a/) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) | -| [DarkSide Ransomware](/stories/darkside_ransomware/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | +| [DarkSide Ransomware](/stories/darkside_ransomware/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) | | [Dynamic DNS](/stories/dynamic_dns/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | -| [Emotet Malware DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | +| [Emotet Malware DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | [Initial Access](/tags/#initial-access) | | [FIN7](/stories/fin7/) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) | -| [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | -| [IcedID](/stories/icedid/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | -| [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | -| [Ransomware](/stories/ransomware/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | +| [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) | +| [IcedID](/stories/icedid/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | +| [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | +| [Ransomware](/stories/ransomware/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | | [Ransomware Cloud](/stories/ransomware_cloud/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | -| [Remcos](/stories/remcos/) | [Screen Capture](/tags/#screen-capture) | [Collection](/tags/#collection) | -| [Revil Ransomware](/stories/revil_ransomware/) | [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) | +| [Remcos](/stories/remcos/) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion) | +| [Revil Ransomware](/stories/revil_ransomware/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) | | [Ryuk Ransomware](/stories/ryuk_ransomware/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | | [SamSam Ransomware](/stories/samsam_ransomware/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | -| [Trickbot](/stories/trickbot/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | -| [Unusual Processes](/stories/unusual_processes/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | -| [Windows File Extension and Association Abuse](/stories/windows_file_extension_and_association_abuse/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows Service Abuse](/stories/windows_service_abuse/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | -| [XMRig](/stories/xmrig/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | \ No newline at end of file +| [Trickbot](/stories/trickbot/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | +| [Unusual Processes](/stories/unusual_processes/) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows File Extension and Association Abuse](/stories/windows_file_extension_and_association_abuse/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Service Abuse](/stories/windows_service_abuse/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | +| [XMRig](/stories/xmrig/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | \ No newline at end of file diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index bedf6ebda7..f6d323f477 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -11,75 +11,75 @@ sidebar: | Name | Technique | Tactic | | ----------- | ----------- |--------------| | [AWS Cross Account Activity](aws_cross_account_activity) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) | -| [AWS IAM Privilege Escalation](aws_iam_privilege_escalation) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) | -| [AWS Network ACL Activity](aws_network_acl_activity) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) | +| [AWS IAM Privilege Escalation](aws_iam_privilege_escalation) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | [Persistence](/tags/#persistence) | +| [AWS Network ACL Activity](aws_network_acl_activity) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | | [AWS Security Hub Alerts]() | None | None | | [AWS User Monitoring](aws_user_monitoring) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | -| [Active Directory Discovery](active_directory_discovery) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | -| [Active Directory Password Spraying](active_directory_password_spraying) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | +| [Active Directory Discovery](active_directory_discovery) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | +| [Active Directory Password Spraying](active_directory_password_spraying) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access) | | [Apache Struts Vulnerability](apache_struts_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | | [Asset Tracking]() | None | None | | [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) | | [Baron Samedit CVE-2021-3156](baron_samedit_cve-2021-3156) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | | [BlackMatter Ransomware](blackmatter_ransomware) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | | [Brand Monitoring]() | None | None | -| [Clop Ransomware](clop_ransomware) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | +| [Clop Ransomware](clop_ransomware) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | | [Cloud Cryptomining](cloud_cryptomining) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | -| [Cloud Federated Credential Abuse](cloud_federated_credential_abuse) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Cobalt Strike](cobalt_strike) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Cloud Federated Credential Abuse](cloud_federated_credential_abuse) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Cobalt Strike](cobalt_strike) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [Defense Evasion](/tags/#defense-evasion) | | [ColdRoot MacOS RAT]() | None | None | | [Collection and Staging](collection_and_staging) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | -| [Command and Control](command_and_control) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | +| [Command and Control](command_and_control) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | | [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) | -| [Credential Dumping](credential_dumping) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | +| [Credential Dumping](credential_dumping) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | | [DHS Report TA18-074A](dhs_report_ta18-074a) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) | -| [DNS Amplification Attacks](dns_amplification_attacks) | [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) | +| [DNS Amplification Attacks](dns_amplification_attacks) | [Network Denial of Service](/tags/#network-denial-of-service), [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) | | [DNS Hijacking](dns_hijacking) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) | -| [DarkSide Ransomware](darkside_ransomware) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Data Exfiltration](data_exfiltration) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) | +| [DarkSide Ransomware](darkside_ransomware) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Data Exfiltration](data_exfiltration) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | | [Data Protection](data_protection) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) | | [Deobfuscate-Decode Files or Information](deobfuscate-decode_files_or_information) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) | | [Detect Zerologon Attack](detect_zerologon_attack) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | | [Dev Sec Ops](dev_sec_ops) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | -| [Disabling Security Tools](disabling_security_tools) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | +| [Disabling Security Tools](disabling_security_tools) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | | [Domain Trust Discovery](domain_trust_discovery) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | | [Dynamic DNS](dynamic_dns) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | -| [Emotet Malware DHS Report TA18-201A ](emotet_malware__dhs_report_ta18-201a_) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | +| [Emotet Malware DHS Report TA18-201A ](emotet_malware__dhs_report_ta18-201a_) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | [Initial Access](/tags/#initial-access) | | [F5 TMUI RCE CVE-2020-5902](f5_tmui_rce_cve-2020-5902) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | | [FIN7](fin7) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) | | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | -| [HAFNIUM Group](hafnium_group) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | -| [Hidden Cobra Malware](hidden_cobra_malware) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | -| [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | +| [HAFNIUM Group](hafnium_group) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | +| [Hidden Cobra Malware](hidden_cobra_malware) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) | +| [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | | [Ingress Tool Transfer](ingress_tool_transfer) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) | | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | | [Kubernetes Sensitive Object Access Activity]() | None | None | -| [Lateral Movement](lateral_movement) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | +| [Lateral Movement](lateral_movement) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | | [Malicious PowerShell](malicious_powershell) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) | -| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | | [Meterpreter](meterpreter) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | -| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | +| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | | [Monitor for Updates]() | None | None | | [NOBELIUM Group](nobelium_group) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | -| [Netsh Abuse](netsh_abuse) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | [Defense Evasion](/tags/#defense-evasion) | -| [Office 365 Detections](office_365_detections) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | [Collection](/tags/#collection) | -| [Orangeworm Attack Group](orangeworm_attack_group) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | +| [Netsh Abuse](netsh_abuse) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | +| [Office 365 Detections](office_365_detections) | [Email Forwarding Rule](/tags/#email-forwarding-rule), [Email Collection](/tags/#email-collection) | [Collection](/tags/#collection) | +| [Orangeworm Attack Group](orangeworm_attack_group) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | | [PetitPotam NTLM Relay on Active Directory Certificate Services](petitpotam_ntlm_relay_on_active_directory_certificate_services) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | -| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Persistence](/tags/#persistence) | -| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | -| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | -| [ProxyShell](proxyshell) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | -| [Ransomware](ransomware) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | +| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) | +| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | +| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | +| [ProxyShell](proxyshell) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | +| [Ransomware](ransomware) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | | [Ransomware Cloud](ransomware_cloud) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | -| [Remcos](remcos) | [Screen Capture](/tags/#screen-capture) | [Collection](/tags/#collection) | -| [Revil Ransomware](revil_ransomware) | [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) | -| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) | +| [Remcos](remcos) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion) | +| [Revil Ransomware](revil_ransomware) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) | +| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Automated Exfiltration](/tags/#automated-exfiltration), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) | | [Ryuk Ransomware](ryuk_ransomware) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | | [SQL Injection](sql_injection) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | | [SamSam Ransomware](samsam_ransomware) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | | [Silver Sparrow](silver_sparrow) | [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection) | -| [Spearphishing Attachments](spearphishing_attachments) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | +| [Spearphishing Attachments](spearphishing_attachments) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | | [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious AWS S3 Activities](suspicious_aws_s3_activities) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | | [Suspicious AWS Traffic]() | None | None | @@ -87,30 +87,30 @@ sidebar: | [Suspicious Cloud Instance Activities](suspicious_cloud_instance_activities) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) | | [Suspicious Cloud Provisioning Activities](suspicious_cloud_provisioning_activities) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious Cloud User Activities](suspicious_cloud_user_activities) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Command-Line Executions](suspicious_command-line_executions) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Compiled HTML Activity](suspicious_compiled_html_activity) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Command-Line Executions](suspicious_command-line_executions) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Compiled HTML Activity](suspicious_compiled_html_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious DNS Traffic](suspicious_dns_traffic) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | -| [Suspicious Emails](suspicious_emails) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | +| [Suspicious Emails](suspicious_emails) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | [Initial Access](/tags/#initial-access) | | [Suspicious GCP Storage Activities](suspicious_gcp_storage_activities) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | -| [Suspicious MSHTA Activity](suspicious_mshta_activity) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Okta Activity](suspicious_okta_activity) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Regsvcs Regasm Activity](suspicious_regsvcs_regasm_activity) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Regsvr32 Activity](suspicious_regsvr32_activity) | [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious MSHTA Activity](suspicious_mshta_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Okta Activity](suspicious_okta_activity) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Regsvcs Regasm Activity](suspicious_regsvcs_regasm_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Regsvr32 Activity](suspicious_regsvr32_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious WMI Use](suspicious_wmi_use) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) | -| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Application Shimming](/tags/#application-shimming) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious Zoom Child Processes](suspicious_zoom_child_processes) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Trickbot](trickbot) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | +| [Trickbot](trickbot) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | | [Trusted Developer Utilities Proxy Execution](trusted_developer_utilities_proxy_execution) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) | -| [Trusted Developer Utilities Proxy Execution MSBuild](trusted_developer_utilities_proxy_execution_msbuild) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | -| [Unusual Processes](unusual_processes) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | +| [Trusted Developer Utilities Proxy Execution MSBuild](trusted_developer_utilities_proxy_execution_msbuild) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [Defense Evasion](/tags/#defense-evasion) | +| [Unusual Processes](unusual_processes) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion) | | [Use of Cleartext Protocols]() | None | None | | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) | -| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | | [Windows Discovery Techniques](windows_discovery_techniques) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) | -| [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows Log Manipulation](windows_log_manipulation) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | -| [Windows Privilege Escalation](windows_privilege_escalation) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | -| [XMRig](xmrig) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | \ No newline at end of file +| [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Log Manipulation](windows_log_manipulation) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | +| [Windows Privilege Escalation](windows_privilege_escalation) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) | +| [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | +| [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | \ No newline at end of file diff --git a/docs/_playbooks/ransomware_investigate_and_contain.md b/docs/_playbooks/ransomware_investigate_and_contain.md index 995e0df85a..35e58c63ff 100644 --- a/docs/_playbooks/ransomware_investigate_and_contain.md +++ b/docs/_playbooks/ransomware_investigate_and_contain.md @@ -111,6 +111,8 @@ This playbook investigates and contains ransomware detected on endpoints. + + @@ -648,6 +650,25 @@ This playbook investigates and contains ransomware detected on endpoints. + + + + + + + + + + + + + + + + + + + diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index 4037afb7b2..7352d879af 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -71,6 +71,7 @@ Legitimate router connections may appear as new connections + #### Reference diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index ea8f14b561..f4d78c9271 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -77,6 +77,7 @@ This search might be prone to high false positives. Please consider this when co + #### Reference diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index fbd273a402..2d312c2e28 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -72,6 +72,7 @@ None identified + #### Reference diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index 29c3160ecb..808690ec16 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -77,6 +77,7 @@ None at this time + #### Reference diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index 421938b9e6..b723bcfbdc 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -1,6 +1,6 @@ --- title: "Large Volume of DNS ANY Queries" -excerpt: "Reflection Amplification" +excerpt: "Network Denial of Service, Reflection Amplification" categories: - Network last_modified_at: 2017-09-20 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Anomaly + - T1498 + - Network Denial of Service + - Impact - T1498.002 - Reflection Amplification - Impact @@ -39,10 +42,17 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | + + | [T1498.002](https://attack.mitre.org/techniques/T1498/002/) | Reflection Amplification | Impact | + + + #### Search ``` @@ -77,6 +87,7 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a + #### Reference diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 8842042978..87a83433f0 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -39,11 +39,14 @@ This search looks for specific GET or HEAD requests to web servers that are indi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery | + + #### Search ``` @@ -81,6 +84,7 @@ It's possible for legitimate HTTP requests to be made to URLs containing the + #### Reference diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index aa523dd6aa..ce1a379a1a 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -74,6 +74,7 @@ No known false positives for this detection. + #### Reference diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 48bbe439f1..0bb9c7af0d 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -68,6 +68,7 @@ None at this time + #### Reference diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index 91570f4aca..42db79bc1e 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -69,6 +69,7 @@ Very few legitimate Content-Type fields will have a length greater than 100 char + #### Reference diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index 6c2049a08a..18e6fe2899 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -75,6 +75,7 @@ None at this time + #### Reference diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index 043d8e0e43..26921a3a47 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -83,6 +83,7 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and + #### Reference diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index a62f77ff34..0b663b625a 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -39,11 +39,14 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000 #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1095](https://attack.mitre.org/techniques/T1095/) | Non-Application Layer Protocol | Command And Control | + + #### Search ``` @@ -84,6 +87,7 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue + #### Reference diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index fd81b707b7..08904bbee4 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -38,11 +38,14 @@ This search looks at S3 bucket-access logs and detects new or previously unseen #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | + + #### Search ``` @@ -86,6 +89,7 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn + #### Reference diff --git a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md index e248c742a2..849f13f22f 100644 --- a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md +++ b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md @@ -72,7 +72,6 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. Y After a new image is created, the first systems created with that image will cause this alert to fire. Verify that the image being used was created by a legitimate user. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -81,6 +80,7 @@ After a new image is created, the first systems created with that image will cau + #### Reference diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index c35cab4b2d..1798e29fbf 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -38,11 +38,14 @@ This search looks for the creation of WMI permanent event subscriptions. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | + + #### Search ``` @@ -82,6 +85,7 @@ Although unlikely, administrators may use event subscriptions for legitimate pur + #### Reference diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index 0a3abb9670..bf1a999f86 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -38,11 +38,14 @@ This search looks for the creation of WMI temporary event subscriptions. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | + + #### Search ``` @@ -80,6 +83,7 @@ Some software may create WMI temporary event subscriptions for various purposes. + #### Reference diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index 93047cff52..6c2914e8e3 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -38,11 +38,14 @@ This search detects users creating spikes in API activity related to deletion of #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | + + #### Search ``` @@ -92,6 +95,7 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p + #### Reference diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index 688f0df248..6a8ef63ad1 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -37,11 +37,14 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators may use this legitimately to gather info from remote systems. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ Administrators may use this legitimately to gather info from remote systems. Fil + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml) diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md index c4c816f70c..86ed279fcc 100644 --- a/docs/_posts/2018-12-03-usn_journal_deletion.md +++ b/docs/_posts/2018-12-03-usn_journal_deletion.md @@ -37,11 +37,14 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + #### Search ``` @@ -80,7 +83,6 @@ You must be ingesting data that records process activity from your hosts to popu None identified - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ None identified + #### Reference diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 5544eeead9..9b9fc4a6fb 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -75,6 +75,7 @@ There are no known false positives. + #### Reference diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md index 8b0f85b3cb..48bec4316b 100644 --- a/docs/_posts/2018-12-14-file_with_samsam_extension.md +++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md @@ -68,7 +68,6 @@ You must be ingesting data that records file-system activity from your hosts to Because these extensions are not typically used in normal operations, you should investigate all results. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -77,6 +76,7 @@ Because these extensions are not typically used in normal operations, you should + #### Reference diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md index a8a216de41..18e4da5802 100644 --- a/docs/_posts/2018-12-14-samsam_test_file_write.md +++ b/docs/_posts/2018-12-14-samsam_test_file_write.md @@ -37,11 +37,14 @@ The search looks for a file named "test.txt" written to the windows syst #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | + + #### Search ``` @@ -76,7 +79,6 @@ You must be ingesting data that records the file-system activity from your hosts No false positives have been identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ No false positives have been identified. + #### Reference diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index 6ba40c5b92..af0a162c31 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -72,6 +72,7 @@ There might be some false positives as keyboard event taps are used by processes + #### Reference diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index 1e7b245d09..1840f20bca 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -39,11 +39,14 @@ This search looks for suspicious processes on all systems labeled as web servers #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery | + + #### Search ``` @@ -81,6 +84,7 @@ Some of these processes may be used legitimately on web servers during maintenan + #### Reference diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 22b9535720..ed517cbe44 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -78,6 +78,7 @@ Some legitimate applications use long command lines for installs or updates. You + #### Reference diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index ef5b8d2e16..fb40deac49 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -1,6 +1,6 @@ --- title: "Detect Credential Dumping through LSASS access" -excerpt: "LSASS Memory" +excerpt: "LSASS Memory, OS Credential Dumping" categories: - Endpoint last_modified_at: 2019-12-03 @@ -11,6 +11,9 @@ tags: - T1003.001 - LSASS Memory - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -36,10 +39,17 @@ This search looks for reading lsass memory consistent with credential dumping. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -79,7 +89,6 @@ This search needs Sysmon Logs and a sysmon configuration, which includes EventCo The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ The activity may be legitimate. Other tools can access lsass for legitimate reas + #### Reference diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index aac20225e9..e27131660c 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -1,6 +1,6 @@ --- title: "Detect Mimikatz Using Loaded Images" -excerpt: "LSASS Memory" +excerpt: "LSASS Memory, OS Credential Dumping" categories: - Endpoint last_modified_at: 2019-12-03 @@ -11,6 +11,9 @@ tags: - T1003.001 - LSASS Memory - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -36,10 +39,17 @@ This search looks for reading loaded Images unique to credential dumping with Mi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -79,7 +89,6 @@ This search needs Sysmon Logs and a sysmon configuration, which includes EventCo Other tools can import the same DLLs. These tools should be part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ Other tools can import the same DLLs. These tools should be part of a whitelist. + #### Reference * [https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html](https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html) diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index 0dd5c25b3b..d5b2cfbb52 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -1,6 +1,6 @@ --- title: "Access LSASS Memory for Dump Creation" -excerpt: "LSASS Memory" +excerpt: "LSASS Memory, OS Credential Dumping" categories: - Endpoint last_modified_at: 2019-12-06 @@ -11,6 +11,9 @@ tags: - T1003.001 - LSASS Memory - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -36,10 +39,17 @@ Detect memory dumping of the LSASS process. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -77,7 +87,6 @@ This search requires Sysmon Logs and a Sysmon configuration, which includes Even Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ Administrators can create memory dumps for debugging purposes, but memory dumps + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index dd2461a047..593eb22987 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -1,6 +1,6 @@ --- title: "Create Remote Thread into LSASS" -excerpt: "LSASS Memory" +excerpt: "LSASS Memory, OS Credential Dumping" categories: - Endpoint last_modified_at: 2019-12-06 @@ -11,6 +11,9 @@ tags: - T1003.001 - LSASS Memory - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -36,10 +39,17 @@ Detect remote thread creation into LSASS consistent with credential dumping. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -77,7 +87,6 @@ This search needs Sysmon Logs with a Sysmon configuration, which includes EventC Other tools can access LSASS for legitimate reasons and generate an event. In these cases, tweaking the search may help eliminate noise. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md index 3e3225f6c1..5c2fa9781e 100644 --- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md +++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md @@ -1,6 +1,6 @@ --- title: "Creation of Shadow Copy" -excerpt: "NTDS" +excerpt: "NTDS, OS Credential Dumping" categories: - Endpoint last_modified_at: 2019-12-10 @@ -11,6 +11,9 @@ tags: - T1003.003 - NTDS - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -82,7 +92,6 @@ You must be ingesting endpoint data that tracks process activity, including pare Legitimate administrator usage of Vssadmin or Wmic will create false positives. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives. + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index b472f501d5..c7d4fd67ca 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -1,6 +1,6 @@ --- title: "DNS Query Length Outliers - MLTK" -excerpt: "DNS" +excerpt: "DNS, Application Layer Protocol" categories: - Network last_modified_at: 2020-01-22 @@ -11,6 +11,9 @@ tags: - T1071.004 - DNS - Command And Control + - T1071 + - Application Layer Protocol + - Command And Control - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +42,17 @@ This search allows you to identify DNS requests that are unusually large for the #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control | + +| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control | + + + + + #### Search ``` @@ -94,6 +104,7 @@ If you are seeing more results than desired, you may consider reducing the value + #### Reference diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index e00c42e7af..3d7b3a22a2 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -1,6 +1,6 @@ --- title: "Creation of lsass Dump with Taskmgr" -excerpt: "LSASS Memory" +excerpt: "LSASS Memory, OS Credential Dumping" categories: - Endpoint last_modified_at: 2020-02-03 @@ -11,6 +11,9 @@ tags: - T1003.001 - LSASS Memory - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -36,10 +39,17 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -75,7 +85,6 @@ This search requires Sysmon Logs and a Sysmon configuration, which includes Even Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ Administrators can create memory dumps for debugging purposes, but memory dumps + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager) diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index 46991326f3..d79f0b644f 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -73,6 +73,7 @@ At this stage, there are no known false positives. During testing, no process ev + #### Reference diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index e1fb0a65e7..43350f0f8c 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -37,11 +37,14 @@ This searches show information on uploaded containers including source user, ima #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence | + + #### Search ``` @@ -71,6 +74,7 @@ Uploading container is a normal behavior from developers or users with access to + #### Reference diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index b9e41e7577..2517e0d11f 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -1,6 +1,6 @@ --- title: "Dump LSASS via comsvcs DLL" -excerpt: "LSASS Memory" +excerpt: "LSASS Memory, OS Credential Dumping" categories: - Endpoint last_modified_at: 2020-02-21 @@ -11,6 +11,9 @@ tags: - T1003.001 - LSASS Memory - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ Detect the usage of comsvcs.dll for dumping the lsass process. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -84,7 +94,6 @@ To successfully implement this search you need to be ingesting information on pr None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ None identified. + #### Reference * [https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/](https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/) diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index 26a4d89bf3..9ef2ff1c43 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2018-8440 - Endpoint - Exploitation --- @@ -39,11 +40,14 @@ This search looks for child processes of spoolsv.exe. This activity is associate #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + #### Search ``` @@ -83,6 +87,14 @@ Some legitimate printer-related processes may show up as children of spoolsv.exe +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2018-8440](https://nvd.nist.gov/vuln/detail/CVE-2018-8440) | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. | 7.2 | + + + #### Reference diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 5ccaf995e6..c309831077 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -82,6 +82,7 @@ Some legitimate processes may be only rarely executed in your environment. As th + #### Reference diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md index ede91ebc19..f663951560 100644 --- a/docs/_posts/2020-03-16-process_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md @@ -37,11 +37,14 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | + + #### Search ``` @@ -77,7 +80,6 @@ You must be ingesting endpoint data that tracks process activity, including pare Although unlikely, administrators may use wmi to execute commands for legitimate purposes. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ Although unlikely, administrators may use wmi to execute commands for legitimate + #### Reference diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md index f5b95a9c6d..87bb411662 100644 --- a/docs/_posts/2020-03-16-script_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md @@ -37,11 +37,14 @@ This search looks for scripts launched via WMI. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | + + #### Search ``` @@ -75,7 +78,6 @@ You must be ingesting endpoint data that tracks process activity, including pare Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +86,7 @@ Although unlikely, administrators may use wmi to launch scripts for legitimate p + #### Reference * [https://redcanary.com/blog/child-processes/](https://redcanary.com/blog/child-processes/) diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index 27f0088083..6311c9638b 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -71,6 +71,7 @@ It is important to understand that if you happen to install any new applications + #### Reference diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index 3809fef107..4dcec2ff04 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -38,11 +38,14 @@ This search provides information of unauthenticated requests via user agent, and #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | + + #### Search ``` @@ -85,6 +88,7 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs + #### Reference diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index f0bcff1de2..8e0a80582e 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -38,11 +38,14 @@ This search provides detection information on unauthenticated requests against K #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | + + #### Search ``` @@ -86,6 +89,7 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs + #### Reference diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index 163f85d2be..6a384190e5 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -37,11 +37,14 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + #### Search ``` @@ -81,7 +84,6 @@ You must be ingesting data that records process activity from your hosts to popu A new child process of zoom isn't malicious by that fact alone. Further investigation of the actions of the child process is needed to verify any malicious behavior is taken. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +92,7 @@ A new child process of zoom isn't malicious by that fact alone. Further inve + #### Reference diff --git a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md index b15712d1dc..fd00890a51 100644 --- a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md +++ b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md @@ -74,7 +74,6 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. Y Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +82,7 @@ Using multiple AWS accounts and roles is perfectly valid behavior. It's susp + #### Reference diff --git a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md index fd52f3048f..b16f799e8d 100644 --- a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md +++ b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md @@ -69,7 +69,6 @@ You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -78,6 +77,7 @@ When a legitimate new user logins for the first time, this activity will be dete + #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index 6e710fc26b..8b2348211a 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -69,6 +69,7 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca + #### Reference diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md index f7b55491b8..60a0b91064 100644 --- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md +++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md @@ -1,6 +1,6 @@ --- title: "Detect Path Interception By Creation Of program exe" -excerpt: "Path Interception by Unquoted Path" +excerpt: "Path Interception by Unquoted Path, Hijack Execution Flow" categories: - Endpoint last_modified_at: 2020-07-03 @@ -13,6 +13,11 @@ tags: - Persistence - Privilege Escalation - Defense Evasion + - T1574 + - Hijack Execution Flow + - Persistence + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +44,17 @@ The detection Detect Path Interception By Creation Of program exe is detecting t #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1574.009](https://attack.mitre.org/techniques/T1574/009/) | Path Interception by Unquoted Path | Persistence, Privilege Escalation, Defense Evasion | + +| [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -91,7 +103,6 @@ You must be ingesting data that records process activity from your hosts to popu unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -100,6 +111,7 @@ unknown + #### Reference * [https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae](https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae) diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md index f7764772c0..7046f7527e 100644 --- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md +++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md @@ -1,6 +1,6 @@ --- title: "Short Lived Windows Accounts" -excerpt: "Local Account" +excerpt: "Local Account, Create Account" categories: - Endpoint last_modified_at: 2020-07-06 @@ -11,6 +11,9 @@ tags: - T1136.001 - Local Account - Persistence + - T1136 + - Create Account + - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -36,10 +39,17 @@ This search detects accounts that were created and deleted in a short time perio #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1136.001](https://attack.mitre.org/techniques/T1136/001/) | Local Account | Persistence | + +| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | + + + + + #### Search ``` @@ -75,7 +85,6 @@ This search requires you to have enabled your Group Management Audit Logs in you It is possible that an administrator created and deleted an account in a short time period. Verifying activity with an administrator is advised. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ It is possible that an administrator created and deleted an account in a short t + #### Reference diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index 0450d3d269..30d3fe723a 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -1,6 +1,6 @@ --- title: "Windows Event Log Cleared" -excerpt: "Clear Windows Event Logs" +excerpt: "Indicator Removal on Host, Clear Windows Event Logs" categories: - Endpoint last_modified_at: 2020-07-06 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1070 + - Indicator Removal on Host + - Defense Evasion - T1070.001 - Clear Windows Event Logs - Defense Evasion @@ -36,10 +39,17 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | + + + #### Search ``` @@ -73,7 +83,6 @@ To successfully implement this search, you need to be ingesting Windows event lo It is possible that these logs may be legitimately cleared by Administrators. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -82,6 +91,7 @@ It is possible that these logs may be legitimately cleared by Administrators. Fi + #### Reference * [https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102) diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index 138253d43f..af390754cc 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -1,6 +1,6 @@ --- title: "Remote Desktop Network Traffic" -excerpt: "Remote Desktop Protocol" +excerpt: "Remote Desktop Protocol, Remote Services" categories: - Network last_modified_at: 2020-07-07 @@ -11,6 +11,9 @@ tags: - T1021.001 - Remote Desktop Protocol - Lateral Movement + - T1021 + - Remote Services + - Lateral Movement - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +42,17 @@ This search looks for network traffic on TCP/3389, the default port used by remo #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + + + + #### Search ``` @@ -84,6 +94,7 @@ Remote Desktop may be used legitimately by users on the network. + #### Reference diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md index ca61b02144..cd4191b738 100644 --- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md +++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md @@ -1,6 +1,6 @@ --- title: "Detect New Local Admin account" -excerpt: "Local Account" +excerpt: "Local Account, Create Account" categories: - Endpoint last_modified_at: 2020-07-08 @@ -11,6 +11,9 @@ tags: - T1136.001 - Local Account - Persistence + - T1136 + - Create Account + - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search looks for newly created accounts that have been elevated to local ad #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1136.001](https://attack.mitre.org/techniques/T1136/001/) | Local Account | Persistence | + +| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | + + + + + #### Search ``` @@ -79,7 +89,6 @@ You must be ingesting Windows event logs using the Splunk Windows TA and collect The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ The activity may be legitimate. For this reason, it's best to verify the acc + #### Reference diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index 7d279f7cb4..bb4d102a2a 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -38,11 +38,14 @@ This search provides information of unauthenticated requests via user agent, and #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | + + #### Search ``` @@ -82,6 +85,7 @@ Not all unauthenticated requests are malicious, but frequency, User Agent, sourc + #### Reference diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index 25b22fe5c6..d811d0844a 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -1,6 +1,6 @@ --- title: "Attempt To Stop Security Service" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2020-07-21 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +41,17 @@ This search looks for attempts to stop security-related services on the endpoint #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -87,7 +97,6 @@ To successfully implement this search you need to be ingesting information on pr None identified. Attempts to disable security-related services should be identified and understood. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -96,6 +105,7 @@ None identified. Attempts to disable security-related services should be identif + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service) diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md index e655b78f98..27cf64b914 100644 --- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md +++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md @@ -1,6 +1,6 @@ --- title: "Detect Excessive User Account Lockouts" -excerpt: "Local Accounts" +excerpt: "Valid Accounts, Local Accounts" categories: - Endpoint last_modified_at: 2020-07-21 @@ -8,6 +8,12 @@ toc: true toc_label: "" tags: - Anomaly + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - T1078.003 - Local Accounts - Defense Evasion @@ -39,10 +45,17 @@ This search detects user accounts that have been locked out a relatively high nu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + | [T1078.003](https://attack.mitre.org/techniques/T1078/003/) | Local Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + #### Search ``` @@ -77,7 +90,6 @@ ou must ingest your Windows security event logs in the `Change` datamodel under It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +98,7 @@ It is possible that a legitimate user is experiencing an issue causing multiple + #### Reference diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index 4c00575181..10c426ffec 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -1,6 +1,6 @@ --- title: "Detect Outbound SMB Traffic" -excerpt: "File Transfer Protocols" +excerpt: "File Transfer Protocols, Application Layer Protocol" categories: - Network last_modified_at: 2020-07-21 @@ -11,6 +11,9 @@ tags: - T1071.002 - File Transfer Protocols - Command And Control + - T1071 + - Application Layer Protocol + - Command And Control - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +43,17 @@ This search looks for outbound SMB connections made by hosts within your network #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1071.002](https://attack.mitre.org/techniques/T1071/002/) | File Transfer Protocols | Command And Control | + +| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control | + + + + + #### Search ``` @@ -86,6 +96,7 @@ It is likely that the outbound Server Message Block (SMB) traffic is legitimate, + #### Reference diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index 5ddead128c..1dc0a63638 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -1,6 +1,6 @@ --- title: "Detect Outlook exe writing a zip file" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2020-07-21 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -39,10 +42,17 @@ This search looks for execution of process `outlook.exe` where the process is wr #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -93,6 +103,7 @@ It is not uncommon for outlook to write legitimate zip files to the disk. + #### Reference diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md index 47aa6a73ac..c01f518624 100644 --- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md +++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md @@ -1,6 +1,6 @@ --- title: "Detect Use of cmd exe to Launch Script Interpreters" -excerpt: "Windows Command Shell" +excerpt: "Command and Scripting Interpreter, Windows Command Shell" categories: - Endpoint last_modified_at: 2020-07-21 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.003 - Windows Command Shell - Execution @@ -37,10 +40,17 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search, you must be ingesting data that records p Some legitimate applications may exhibit this behavior. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ Some legitimate applications may exhibit this behavior. + #### Reference diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index 8a2150aba9..28cf5587e3 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -41,11 +41,14 @@ This search looks for specific command-line arguments that may indicate the exec #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1072](https://attack.mitre.org/techniques/T1072/) | Software Deployment Tools | Execution, Lateral Movement | + + #### Search ``` @@ -83,6 +86,7 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that + #### Reference diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index a068ff8738..0f52a2346a 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -1,6 +1,6 @@ --- title: "Email files written outside of the Outlook directory" -excerpt: "Local Email Collection" +excerpt: "Email Collection, Local Email Collection" categories: - Application last_modified_at: 2020-07-21 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1114 + - Email Collection + - Collection - T1114.001 - Local Email Collection - Collection @@ -39,10 +42,17 @@ The search looks at the change-analysis data model and detects email files creat #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | + + | [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection | + + + #### Search ``` @@ -80,6 +90,7 @@ Administrators and users sometimes prefer backing up their email data by moving + #### Reference diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index ef1a8f7eb1..f0e9f2151a 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -1,6 +1,6 @@ --- title: "Email servers sending high volume traffic to hosts" -excerpt: "Remote Email Collection" +excerpt: "Email Collection, Remote Email Collection" categories: - Application last_modified_at: 2020-07-21 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Anomaly + - T1114 + - Email Collection + - Collection - T1114.002 - Remote Email Collection - Collection @@ -39,10 +42,17 @@ This search looks for an increase of data transfers from your email server to yo #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | + + | [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection | + + + #### Search ``` @@ -83,6 +93,7 @@ The false-positive rate will vary based on how you set the deviation_threshold a + #### Reference diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index e89e6d5791..c0bbe6ee27 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -1,6 +1,6 @@ --- title: "Excessive DNS Failures" -excerpt: "DNS" +excerpt: "DNS, Application Layer Protocol" categories: - Network last_modified_at: 2020-07-21 @@ -11,6 +11,9 @@ tags: - T1071.004 - DNS - Command And Control + - T1071 + - Application Layer Protocol + - Command And Control - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +42,17 @@ This search identifies DNS query failures by counting the number of DNS response #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control | + +| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control | + + + + + #### Search ``` @@ -84,6 +94,7 @@ It is possible legitimate traffic can trigger this rule. Please investigate as a + #### Reference diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 41dc0d39e6..d2238fbc53 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -1,6 +1,6 @@ --- title: "First Time Seen Running Windows Service" -excerpt: "Service Execution" +excerpt: "System Services, Service Execution" categories: - Endpoint last_modified_at: 2020-07-21 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Anomaly + - T1569 + - System Services + - Execution - T1569.002 - Service Execution - Execution @@ -39,10 +42,17 @@ This search looks for the first and last time a Windows service is seen running #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution | + + | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | + + + #### Search ``` @@ -82,6 +92,7 @@ A previously unseen service is not necessarily malicious. Verify that the servic + #### Reference diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md index 181963f5ca..55be144660 100644 --- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md +++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md @@ -1,6 +1,6 @@ --- title: "Hiding Files And Directories With Attrib exe" -excerpt: "Windows File and Directory Permissions Modification" +excerpt: "File and Directory Permissions Modification, Windows File and Directory Permissions Modification" categories: - Endpoint last_modified_at: 2020-07-21 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1222 + - File and Directory Permissions Modification + - Defense Evasion - T1222.001 - Windows File and Directory Permissions Modification - Defense Evasion @@ -37,10 +40,17 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | + + | [T1222.001](https://attack.mitre.org/techniques/T1222/001/) | Windows File and Directory Permissions Modification | Defense Evasion | + + + #### Search ``` @@ -77,7 +87,6 @@ You must be ingesting data that records process activity from your hosts to popu Some applications and users may legitimately use attrib.exe to interact with the files. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ Some applications and users may legitimately use attrib.exe to interact with the + #### Reference diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index 3811759cab..f1f4ac485d 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -1,6 +1,6 @@ --- title: "Hosts receiving high volume of network traffic from email server" -excerpt: "Remote Email Collection" +excerpt: "Remote Email Collection, Email Collection" categories: - Network last_modified_at: 2020-07-21 @@ -11,6 +11,9 @@ tags: - T1114.002 - Remote Email Collection - Collection + - T1114 + - Email Collection + - Collection - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +42,17 @@ This search looks for an increase of data transfers from your email server to yo #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection | + +| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | + + + + + #### Search ``` @@ -82,6 +92,7 @@ The false-positive rate will vary based on how you set the deviation_threshold a + #### Reference diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index db6fdd2803..95de135498 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -1,6 +1,6 @@ --- title: "Malicious PowerShell Process - Execution Policy Bypass" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2020-07-21 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -38,10 +41,17 @@ This search looks for PowerShell processes started with parameters used to bypas #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -85,7 +95,6 @@ To successfully implement this search you need to be ingesting information on pr There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +103,7 @@ There may be legitimate reasons to bypass the PowerShell execution policy. The P + #### Reference diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index c9fe0ff09c..4adc8781ed 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -1,6 +1,6 @@ --- title: "Multiple Okta Users With Invalid Credentials From The Same IP" -excerpt: "Default Accounts" +excerpt: "Valid Accounts, Default Accounts" categories: - Application last_modified_at: 2020-07-21 @@ -8,6 +8,12 @@ toc: true toc_label: "" tags: - TTP + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - T1078.001 - Default Accounts - Defense Evasion @@ -40,10 +46,17 @@ This search detects Okta login failures due to bad credentials for multiple user #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + #### Search ``` @@ -83,6 +96,7 @@ A single public IP address servicing multiple legitmate users may trigger this s + #### Reference diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index a3ffe1effe..29ee75b530 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -1,6 +1,6 @@ --- title: "Okta Account Lockout Events" -excerpt: "Default Accounts" +excerpt: "Valid Accounts, Default Accounts" categories: - Application last_modified_at: 2020-07-21 @@ -8,6 +8,12 @@ toc: true toc_label: "" tags: - Anomaly + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - T1078.001 - Default Accounts - Defense Evasion @@ -40,10 +46,17 @@ Detect Okta user lockout events #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + #### Search ``` @@ -77,6 +90,7 @@ None. Account lockouts should be followed up on to determine if the actual user + #### Reference diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index c78d22c437..1eb506d0df 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -1,6 +1,6 @@ --- title: "Okta Failed SSO Attempts" -excerpt: "Default Accounts" +excerpt: "Valid Accounts, Default Accounts" categories: - Application last_modified_at: 2020-07-21 @@ -8,6 +8,12 @@ toc: true toc_label: "" tags: - Anomaly + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - T1078.001 - Default Accounts - Defense Evasion @@ -40,10 +46,17 @@ Detect failed Okta SSO events #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + #### Search ``` @@ -79,6 +92,7 @@ There may be a faulty config preventing legitmate users from accessing apps they + #### Reference diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index 5be788a3f1..5c665bcba2 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -1,6 +1,6 @@ --- title: "Okta User Logins From Multiple Cities" -excerpt: "Default Accounts" +excerpt: "Valid Accounts, Default Accounts" categories: - Application last_modified_at: 2020-07-21 @@ -8,6 +8,12 @@ toc: true toc_label: "" tags: - Anomaly + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - T1078.001 - Default Accounts - Defense Evasion @@ -40,10 +46,17 @@ This search detects logins from the same user from different cities in a 24 hour #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + #### Search ``` @@ -79,6 +92,7 @@ Users in your enviornment may legitmately be travelling and loggin in from diffe + #### Reference diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md index 9c14a63a65..4204a59351 100644 --- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md +++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md @@ -1,6 +1,6 @@ --- title: "Overwriting Accessibility Binaries" -excerpt: "Accessibility Features" +excerpt: "Event Triggered Execution, Accessibility Features" categories: - Endpoint last_modified_at: 2020-07-21 @@ -8,6 +8,10 @@ toc: true toc_label: "" tags: - TTP + - T1546 + - Event Triggered Execution + - Privilege Escalation + - Persistence - T1546.008 - Accessibility Features - Privilege Escalation @@ -38,10 +42,17 @@ Microsoft Windows contains accessibility features that can be launched with a ke #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Privilege Escalation, Persistence | + + | [T1546.008](https://attack.mitre.org/techniques/T1546/008/) | Accessibility Features | Privilege Escalation, Persistence | + + + #### Search ``` @@ -76,7 +87,6 @@ You must be ingesting data that records the filesystem activity from your hosts Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +95,7 @@ Microsoft may provide updates to these binaries. Verify that these changes do no + #### Reference diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index 0a827620c7..b33806b83c 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -40,11 +40,14 @@ This search looks for network traffic defined by port and transport layer protoc #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | + + #### Search ``` @@ -86,6 +89,7 @@ None identified + #### Reference diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index bb97c0ab6f..1742d5d0ff 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -1,6 +1,6 @@ --- title: "Protocol or Port Mismatch" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" +excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Exfiltration Over Alternative Protocol" categories: - Network last_modified_at: 2020-07-21 @@ -11,6 +11,9 @@ tags: - T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol - Exfiltration + - T1048 + - Exfiltration Over Alternative Protocol + - Exfiltration - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +42,17 @@ This search looks for network traffic on common ports where a higher layer proto #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | + +| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | + + + + + #### Search ``` @@ -80,6 +90,7 @@ None identified + #### Reference diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index 8e972c5485..ce6e3a2588 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -1,6 +1,6 @@ --- title: "Remote Desktop Network Bruteforce" -excerpt: "Remote Desktop Protocol" +excerpt: "Remote Desktop Protocol, Remote Services" categories: - Network last_modified_at: 2020-07-21 @@ -11,6 +11,9 @@ tags: - T1021.001 - Remote Desktop Protocol - Lateral Movement + - T1021 + - Remote Services + - Lateral Movement - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +43,17 @@ This search looks for RDP application network traffic and filters any source/des #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + + + + #### Search ``` @@ -83,6 +93,7 @@ RDP gateways may have unusually high amounts of traffic from all other hosts' + #### Reference diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index ec8f2a636f..44f00e1416 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -1,6 +1,6 @@ --- title: "Remote Desktop Process Running On System" -excerpt: "Remote Desktop Protocol" +excerpt: "Remote Desktop Protocol, Remote Services" categories: - Endpoint last_modified_at: 2020-07-21 @@ -11,6 +11,9 @@ tags: - T1021.001 - Remote Desktop Protocol - Lateral Movement + - T1021 + - Remote Services + - Lateral Movement - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +42,17 @@ This search looks for the remote desktop process mstsc.exe running on systems up #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + + + + #### Search ``` @@ -80,6 +90,7 @@ Remote Desktop may be used legitimately by users on the network. + #### Reference diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md index dfc817ea3b..7ef0eaf770 100644 --- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md +++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md @@ -1,6 +1,6 @@ --- title: "Sc exe Manipulating Windows Services" -excerpt: "Windows Service" +excerpt: "Windows Service, Create or Modify System Process" categories: - Endpoint last_modified_at: 2020-07-21 @@ -12,6 +12,10 @@ tags: - Windows Service - Persistence - Privilege Escalation + - T1543 + - Create or Modify System Process + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ This search looks for arguments to sc.exe indicating the creation or modificatio #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | + +| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -82,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +101,7 @@ Using sc.exe to manipulate Windows services is uncommon. However, there may be l + #### Reference diff --git a/docs/_posts/2020-07-21-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2020-07-21-schtasks_scheduling_job_on_remote_system.md index a585437fdc..25c04dfbac 100644 --- a/docs/_posts/2020-07-21-schtasks_scheduling_job_on_remote_system.md +++ b/docs/_posts/2020-07-21-schtasks_scheduling_job_on_remote_system.md @@ -1,6 +1,6 @@ --- title: "Schtasks scheduling job on remote system" -excerpt: "Scheduled Task" +excerpt: "Scheduled Task, Scheduled Task/Job" categories: - Endpoint last_modified_at: 2020-07-21 @@ -13,6 +13,11 @@ tags: - Execution - Persistence - Privilege Escalation + - T1053 + - Scheduled Task/Job + - Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +44,17 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | + +| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -79,7 +91,6 @@ You must be ingesting data that records process activity from your hosts to popu Administrators may create jobs on remote systems, but this activity is usually limited to a small set of hosts or users. It is important to validate and investigate as appropriate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +99,7 @@ Administrators may create jobs on remote systems, but this activity is usually l + #### Reference diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md index 7b3b9aab56..57ae1d7c14 100644 --- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md +++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md @@ -39,11 +39,14 @@ This search looks for long URLs that have several SQL commands visible within th #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | + + #### Search ``` @@ -83,6 +86,7 @@ It's possible that legitimate traffic will have long URLs or long user agent + #### Reference diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index 6ab1fafba8..1c95caa1e6 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -1,6 +1,6 @@ --- title: "SMB Traffic Spike" -excerpt: "SMB/Windows Admin Shares" +excerpt: "SMB/Windows Admin Shares, Remote Services" categories: - Network last_modified_at: 2020-07-22 @@ -11,6 +11,9 @@ tags: - T1021.002 - SMB/Windows Admin Shares - Lateral Movement + - T1021 + - Remote Services + - Lateral Movement - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +42,17 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + + + + #### Search ``` @@ -84,6 +94,7 @@ A file server may experience high-demand loads that could cause this analytic to + #### Reference diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index cfda388b41..80cb7fdc11 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -1,6 +1,6 @@ --- title: "SMB Traffic Spike - MLTK" -excerpt: "SMB/Windows Admin Shares" +excerpt: "SMB/Windows Admin Shares, Remote Services" categories: - Network last_modified_at: 2020-07-22 @@ -11,6 +11,9 @@ tags: - T1021.002 - SMB/Windows Admin Shares - Lateral Movement + - T1021 + - Remote Services + - Lateral Movement - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +42,17 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + + + + #### Search ``` @@ -90,6 +100,7 @@ If you are seeing more results than desired, you may consider reducing the value + #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index c267706c08..3123481db1 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -1,6 +1,6 @@ --- title: "Suspicious Email Attachment Extensions" -excerpt: "Spearphishing Attachment" +excerpt: "Spearphishing Attachment, Phishing" categories: - Application last_modified_at: 2020-07-22 @@ -11,6 +11,9 @@ tags: - T1566.001 - Spearphishing Attachment - Initial Access + - T1566 + - Phishing + - Initial Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +42,17 @@ This search looks for emails that have attachments with suspicious file extensio #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + + + + #### Search ``` @@ -82,6 +92,7 @@ None identified + #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md index f21ed117a1..51ed95ce53 100644 --- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md +++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md @@ -37,11 +37,14 @@ This search looks for reg.exe being launched from a command prompt not started b #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + + #### Search ``` @@ -89,7 +92,6 @@ You must be ingesting data that records process activity from your hosts to popu It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -98,6 +100,7 @@ It's possible for system administrators to write scripts that exhibit this b + #### Reference * [https://car.mitre.org/wiki/CAR-2013-03-001](https://car.mitre.org/wiki/CAR-2013-03-001) diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md index c40f1300e5..09f5c86ed1 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md @@ -35,11 +35,14 @@ This search detects writes to the recycle bin by a process other than explorer.e #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + + #### Search ``` @@ -80,7 +83,6 @@ To successfully implement this search you need to be ingesting information on fi Because the Recycle Bin is a hidden folder in modern versions of Windows, it would be unusual for a process other than explorer.exe to write to it. Incidents should be investigated as appropriate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ Because the Recycle Bin is a hidden folder in modern versions of Windows, it wou + #### Reference diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index 187d77a577..6c15cdf490 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -1,6 +1,6 @@ --- title: "TOR Traffic" -excerpt: "Web Protocols" +excerpt: "Application Layer Protocol, Web Protocols" categories: - Network last_modified_at: 2020-07-22 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1071 + - Application Layer Protocol + - Command And Control - T1071.001 - Web Protocols - Command And Control @@ -39,10 +42,17 @@ This search looks for network traffic identified as The Onion Router (TOR), a be #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control | + + | [T1071.001](https://attack.mitre.org/techniques/T1071/001/) | Web Protocols | Command And Control | + + + #### Search ``` @@ -83,6 +93,7 @@ None at this time + #### Reference diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md index bcb6e5def5..3075ba7704 100644 --- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md +++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md @@ -1,6 +1,6 @@ --- title: "Unload Sysmon Filter Driver" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2020-07-22 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ Attackers often disable security tools to avoid detection. This search looks for #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -78,7 +88,6 @@ You must be ingesting data that records process activity from your hosts to popu - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ You must be ingesting data that records process activity from your hosts to popu + #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index 7c9fc50eb6..dc4b957850 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -41,11 +41,14 @@ This search provides detection of an user attaching itself to a different role t #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -77,6 +80,7 @@ Attach to policy can create a lot of noise. This search can be adjusted to provi + #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index 7d0f124029..fd58811fb3 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -41,11 +41,14 @@ This search provides detection of accounts creating permanent keys. Permanent ke #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -87,6 +90,7 @@ Not all permanent key creations are malicious. If there is a policy of rotating + #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index ece6c93b0e..abde17faab 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -41,11 +41,14 @@ This search provides detection of role creation by IAM users. Role creation is a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -92,6 +95,7 @@ CreateRole is not very common in common users. This search can be adjusted to pr + #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index 43a9307625..62b26bee59 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -41,11 +41,14 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -86,6 +89,7 @@ Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross + #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index e6275dc3f5..6b415bd65e 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -39,11 +39,14 @@ This search provides detection of suspicious use of sts:GetSessionToken. These t #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1550](https://attack.mitre.org/techniques/T1550/) | Use Alternate Authentication Material | Defense Evasion, Lateral Movement | + + #### Search ``` @@ -85,6 +88,7 @@ Sts:GetSessionToken can be very noisy as in certain environments numerous calls + #### Reference diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 8e10d7f4c4..f7b40554af 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2020-1350 - Exploitation --- @@ -38,11 +39,14 @@ This search detects SIGRed via Splunk Stream. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution | + + #### Search ``` @@ -79,6 +83,14 @@ unknown +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2020-1350](https://nvd.nist.gov/vuln/detail/CVE-2020-1350) | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. | 10.0 | + + + #### Reference * [https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/](https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/) diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index f0e419709d..c73b07bf86 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2020-1350 - Network_Resolution - Exploitation --- @@ -39,11 +40,14 @@ This search detects SIGRed via Zeek DNS and Zeek Conn data. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution | + + #### Search ``` @@ -84,6 +88,14 @@ unknown +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2020-1350](https://nvd.nist.gov/vuln/detail/CVE-2020-1350) | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. | 10.0 | + + + #### Reference * [https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/](https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/) diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md index bedbdf9670..7b94dc2969 100644 --- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md +++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md @@ -1,6 +1,6 @@ --- title: "Cloud Instance Modified By Previously Unseen User" -excerpt: "Cloud Accounts" +excerpt: "Cloud Accounts, Valid Accounts" categories: - Cloud last_modified_at: 2020-07-29 @@ -14,6 +14,12 @@ tags: - Persistence - Privilege Escalation - Initial Access + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -40,10 +46,17 @@ This search looks for cloud instances being modified by users who have not previ #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + + + #### Search ``` @@ -84,7 +97,6 @@ This search has a dependency on other searches to create and update a baseline o It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +105,7 @@ It's possible that a new user will start to modify EC2 instances when they h + #### Reference diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index 5159794ccc..1035dc10ee 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2020-5902 - Exploitation --- @@ -38,11 +39,14 @@ This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traff #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | + + #### Search ``` @@ -73,6 +77,14 @@ unknown +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2020-5902](https://nvd.nist.gov/vuln/detail/CVE-2020-5902) | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. | 10.0 | + + + #### Reference * [https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/](https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/) diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index bc3bfd24d6..7ff5f21392 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -38,11 +38,14 @@ This search looks for GCP PubSub events where a user has created an open/public #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | + + #### Search ``` @@ -89,6 +92,7 @@ While this search has no known false positives, it is possible that a GCP admin + #### Reference diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index be9d056ca2..bb0f93af01 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -38,11 +38,14 @@ This search looks at GCP Storage bucket-access logs and detects new or previousl #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | + + #### Search ``` @@ -93,6 +96,7 @@ GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow i + #### Reference diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index 95c57d4f38..03d9cb978d 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -1,6 +1,6 @@ --- title: "Detect ARP Poisoning" -excerpt: "Hardware Additions, Network Denial of Service, ARP Cache Poisoning" +excerpt: "Hardware Additions, Network Denial of Service, Man-in-the-Middle, ARP Cache Poisoning" categories: - Network last_modified_at: 2020-08-11 @@ -14,6 +14,10 @@ tags: - T1498 - Network Denial of Service - Impact + - T1557 + - Man-in-the-Middle + - Credential Access + - Collection - T1557.002 - ARP Cache Poisoning - Credential Access @@ -47,12 +51,25 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access | + + + | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | + + + +| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection | + + | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection | + + + #### Search ``` @@ -94,6 +111,7 @@ This search might be prone to high false positives if DHCP Snooping or ARP inspe + #### Reference diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index 1955d7bc0e..399a994ef5 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -47,13 +47,22 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization' #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access | + + + | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | + + + | [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection | + + #### Search ``` @@ -92,6 +101,7 @@ This search might be prone to high false positives if DHCP Snooping has been inc + #### Reference diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md index fdb4c8e8b8..38f51c5a6c 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md @@ -40,11 +40,14 @@ This search looks for cloud provisioning activities from previously unseen IP ad #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -86,7 +89,6 @@ This is a strictly behavioral search, so we define "false positive" slig This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +97,7 @@ This is a strictly behavioral search, so we define "false positive" slig + #### Reference diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md index 69436491c3..c29c010de4 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md @@ -40,11 +40,14 @@ This search looks for cloud provisioning activities from previously unseen regio #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -88,7 +91,6 @@ This is a strictly behavioral search, so we define "false positive" slig This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -97,6 +99,7 @@ This is a strictly behavioral search, so we define "false positive" slig + #### Reference diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index 62faf29186..c590bfb723 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -1,6 +1,6 @@ --- title: "Abnormally High Number Of Cloud Instances Destroyed" -excerpt: "Cloud Accounts" +excerpt: "Cloud Accounts, Valid Accounts" categories: - Cloud last_modified_at: 2020-08-21 @@ -14,6 +14,12 @@ tags: - Persistence - Privilege Escalation - Initial Access + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -43,10 +49,17 @@ This search finds for the number successfully destroyed cloud instances for ever #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + + + #### Search ``` @@ -94,6 +107,7 @@ Many service accounts configured within a cloud infrastructure are known to exhi + #### Reference diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index ee88833afa..9e22c841b2 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -1,6 +1,6 @@ --- title: "Abnormally High Number Of Cloud Instances Launched" -excerpt: "Cloud Accounts" +excerpt: "Cloud Accounts, Valid Accounts" categories: - Cloud last_modified_at: 2020-08-21 @@ -14,6 +14,12 @@ tags: - Persistence - Privilege Escalation - Initial Access + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -43,10 +49,17 @@ This search finds for the number successfully created cloud instances for every #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + + + #### Search ``` @@ -95,6 +108,7 @@ Many service accounts configured within an AWS infrastructure are known to exhib + #### Reference diff --git a/docs/_posts/2020-08-25-more_than_usual_number_of_lolbas_applications_in_short_time_period.md b/docs/_posts/2020-08-25-more_than_usual_number_of_lolbas_applications_in_short_time_period.md index cc25e0ddfb..9d24f55314 100644 --- a/docs/_posts/2020-08-25-more_than_usual_number_of_lolbas_applications_in_short_time_period.md +++ b/docs/_posts/2020-08-25-more_than_usual_number_of_lolbas_applications_in_short_time_period.md @@ -39,12 +39,18 @@ Attacker activity may compromise executing several LOLBAS applications in conjun #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + + | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + #### Search ``` @@ -83,7 +89,6 @@ Some administrative tasks may involve multiple use of LOLBAS applications in a s - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +97,7 @@ Some administrative tasks may involve multiple use of LOLBAS applications in a s + #### Reference * [https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries](https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries) diff --git a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md index 552967aa3a..f0ad0597d9 100644 --- a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md +++ b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md @@ -36,11 +36,14 @@ Malicious mails can conduct phishing that induces readers to open attachment, cl #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + #### Search ``` @@ -77,6 +80,7 @@ Because of imbalance of anomaly data in training, the model will less likely rep + #### Reference diff --git a/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md b/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md index 74e2e21c02..81c7b17c43 100644 --- a/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md +++ b/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md @@ -34,11 +34,14 @@ An attacker tries might try to use different version of a system command without #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + + #### Search ``` @@ -99,7 +102,6 @@ Collect endpoint data such as sysmon or 4688 events. None - #### RBA | Risk Score | Impact | Confidence | Message | @@ -108,6 +110,7 @@ None + #### Reference diff --git a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md index fe738a11e4..65ea91d39c 100644 --- a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md +++ b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md @@ -38,11 +38,14 @@ This search looks at cloud-infrastructure events where an instance is created in #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | + + #### Search ``` @@ -82,7 +85,6 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. Y It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ It's possible that a user has unknowingly started an instance in a new regio + #### Reference diff --git a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md index 4e24ad4d1b..bf79b26d73 100644 --- a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md +++ b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md @@ -40,11 +40,14 @@ This search looks for new commands from each user role. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -85,7 +88,6 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. . - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +96,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. + #### Reference diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md index 3e97386ca4..effbbd37ed 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md @@ -1,6 +1,6 @@ --- title: "Abnormally High Number Of Cloud Infrastructure API Calls" -excerpt: "Cloud Accounts" +excerpt: "Cloud Accounts, Valid Accounts" categories: - Cloud last_modified_at: 2020-09-07 @@ -14,6 +14,12 @@ tags: - Persistence - Privilege Escalation - Initial Access + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -41,10 +47,17 @@ This search will detect a spike in the number of API calls made to your cloud in #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + + + #### Search ``` @@ -89,7 +102,6 @@ You must be ingesting your cloud infrastructure logs. You also must run the base - #### RBA | Risk Score | Impact | Confidence | Message | @@ -98,6 +110,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base + #### Reference diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md index 15038a00d8..e4f393580f 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md @@ -1,6 +1,6 @@ --- title: "Abnormally High Number Of Cloud Security Group API Calls" -excerpt: "Cloud Accounts" +excerpt: "Cloud Accounts, Valid Accounts" categories: - Cloud last_modified_at: 2020-09-07 @@ -14,6 +14,12 @@ tags: - Persistence - Privilege Escalation - Initial Access + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -41,10 +47,17 @@ This search will detect a spike in the number of API calls made to your cloud in #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + + + #### Search ``` @@ -90,7 +103,6 @@ You must be ingesting your cloud infrastructure logs. You also must run the base - #### RBA | Risk Score | Impact | Confidence | Message | @@ -99,6 +111,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base + #### Reference diff --git a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md index 8bba8c587f..6c405321de 100644 --- a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md @@ -72,7 +72,6 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. Y It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -81,6 +80,7 @@ It is possible that an admin will create a new system using a new instance type + #### Reference diff --git a/docs/_posts/2020-09-15-detect_dump_lsass_memory_using_comsvcs.md b/docs/_posts/2020-09-15-detect_dump_lsass_memory_using_comsvcs.md index 0f433a602c..8997c70b27 100644 --- a/docs/_posts/2020-09-15-detect_dump_lsass_memory_using_comsvcs.md +++ b/docs/_posts/2020-09-15-detect_dump_lsass_memory_using_comsvcs.md @@ -1,6 +1,6 @@ --- title: "Detect Dump LSASS Memory using comsvcs" -excerpt: "NTDS" +excerpt: "NTDS, OS Credential Dumping" categories: - Endpoint last_modified_at: 2020-09-15 @@ -11,6 +11,9 @@ tags: - T1003.003 - NTDS - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Behavioral Analytics - Actions on Objectives --- @@ -34,10 +37,17 @@ This search detects the memory of lsass.exe being dumped for offline credential #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -72,7 +82,6 @@ You must be ingesting endpoint data that tracks process activity, including Wind None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -81,6 +90,7 @@ None identified. + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index 9f52d4e126..2035905f5e 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2020-1472 - Exploitation --- @@ -38,11 +39,14 @@ This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vul #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | + + #### Search ``` @@ -75,6 +79,14 @@ unknown +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2020-1472](https://nvd.nist.gov/vuln/detail/CVE-2020-1472) | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. | 9.3 | + + + #### Reference * [https://www.secura.com/blog/zero-logon](https://www.secura.com/blog/zero-logon) diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index 4bf46032ea..57e3bc7984 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -1,6 +1,6 @@ --- title: "Create or delete windows shares using net exe" -excerpt: "Network Share Connection Removal" +excerpt: "Indicator Removal on Host, Network Share Connection Removal" categories: - Endpoint last_modified_at: 2020-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1070 + - Indicator Removal on Host + - Defense Evasion - T1070.005 - Network Share Connection Removal - Defense Evasion @@ -37,10 +40,17 @@ This search looks for the creation or deletion of hidden shares using net.exe. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + | [T1070.005](https://attack.mitre.org/techniques/T1070/005/) | Network Share Connection Removal | Defense Evasion | + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ Administrators often leverage net.exe to create or delete network shares. You sh + #### Reference * [https://attack.mitre.org/techniques/T1070/005](https://attack.mitre.org/techniques/T1070/005) diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index e6800fd273..f612f4ebbd 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2020-1472 - Actions on Objectives --- @@ -36,11 +37,14 @@ This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An ac #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1210](https://attack.mitre.org/techniques/T1210/) | Exploitation of Remote Services | Lateral Movement | + + #### Search ``` @@ -73,7 +77,6 @@ This search requires audit computer account management to be enabled on the syst None thus far found - #### RBA | Risk Score | Impact | Confidence | Message | @@ -82,6 +85,14 @@ None thus far found +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2020-1472](https://nvd.nist.gov/vuln/detail/CVE-2020-1472) | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. | 9.3 | + + + #### Reference * [https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/](https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/) diff --git a/docs/_posts/2020-10-06-unusually_long_command_line.md b/docs/_posts/2020-10-06-unusually_long_command_line.md index 2d4bf20c39..5df4c45da1 100644 --- a/docs/_posts/2020-10-06-unusually_long_command_line.md +++ b/docs/_posts/2020-10-06-unusually_long_command_line.md @@ -71,7 +71,6 @@ You must be ingesting sysmon endpoint data that monitors command lines. This detection may flag suspiciously long command lines when there is not sufficient evidence (samples) for a given process that this detection is tracking; or when there is high variability in the length of the command line for the tracked process. Also, some legitimate applications may use long command lines. Such is the case of Ansible, that encodes Powershell scripts using long base64. Attackers may use this technique to obfuscate their payloads. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -80,6 +79,7 @@ This detection may flag suspiciously long command lines when there is not suffic + #### Reference diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md index 29cba63514..5a406fb90f 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md @@ -38,11 +38,14 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | + + #### Search ``` @@ -87,7 +90,6 @@ You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -96,6 +98,7 @@ When a legitimate new user logins for the first time, this activity will be dete + #### Reference diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md index fb1571941f..e8ca6faff0 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md @@ -38,11 +38,14 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | + + #### Search ``` @@ -87,7 +90,6 @@ You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -96,6 +98,7 @@ When a legitimate new user logins for the first time, this activity will be dete + #### Reference diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md index 0fb8175068..655a0a1b0a 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md @@ -38,11 +38,14 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | + + #### Search ``` @@ -87,7 +90,6 @@ You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -96,6 +98,7 @@ When a legitimate new user logins for the first time, this activity will be dete + #### Reference diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index c7ebbb0fe2..ee78e118f3 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -41,11 +41,14 @@ This search provides detection of GCPloit exploitation framework. This framework #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -83,6 +86,7 @@ Payload.request.function.timeout value can possibly be match with other function + #### Reference * [https://github.com/dxa4481/gcploit](https://github.com/dxa4481/gcploit) diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md index a38325a326..2a56c547f8 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md @@ -40,11 +40,14 @@ This search looks for cloud provisioning activities from previously unseen citie #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -88,7 +91,6 @@ This is a strictly behavioral search, so we define "false positive" slig This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -97,6 +99,7 @@ This is a strictly behavioral search, so we define "false positive" slig + #### Reference diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md index 956fb10579..46a2283d61 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md @@ -40,11 +40,14 @@ This search looks for cloud provisioning activities from previously unseen count #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -88,7 +91,6 @@ This is a strictly behavioral search, so we define "false positive" slig This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -97,6 +99,7 @@ This is a strictly behavioral search, so we define "false positive" slig + #### Reference diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md index 78f425286a..cb51e97ff3 100644 --- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md +++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md @@ -1,6 +1,6 @@ --- title: "Detect Activity Related to Pass the Hash Attacks" -excerpt: "Pass the Hash" +excerpt: "Use Alternate Authentication Material, Pass the Hash" categories: - Endpoint last_modified_at: 2020-10-15 @@ -8,6 +8,10 @@ toc: true toc_label: "" tags: - TTP + - T1550 + - Use Alternate Authentication Material + - Defense Evasion + - Lateral Movement - T1550.002 - Pass the Hash - Defense Evasion @@ -37,10 +41,17 @@ This search looks for specific authentication events from the Windows Security E #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1550](https://attack.mitre.org/techniques/T1550/) | Use Alternate Authentication Material | Defense Evasion, Lateral Movement | + + | [T1550.002](https://attack.mitre.org/techniques/T1550/002/) | Pass the Hash | Defense Evasion, Lateral Movement | + + + #### Search ``` @@ -77,7 +88,6 @@ To successfully implement this search, you must ingest your Windows Security Eve Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +96,7 @@ Legitimate logon activity by authorized NTLM systems may be detected by this sea + #### Reference diff --git a/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md index c2ab220c76..a15f01c783 100644 --- a/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md +++ b/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md @@ -1,6 +1,6 @@ --- title: "Kerberoasting spn request with RC4 encryption" -excerpt: "Kerberoasting" +excerpt: "Kerberoasting, Steal or Forge Kerberos Tickets" categories: - Endpoint last_modified_at: 2020-10-16 @@ -11,6 +11,9 @@ tags: - T1558.003 - Kerberoasting - Credential Access + - T1558 + - Steal or Forge Kerberos Tickets + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -36,10 +39,17 @@ This search detects a potential kerberoasting attack via service principal name #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access | + +| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access | + + + + + #### Search ``` @@ -75,7 +85,6 @@ You must be ingesting endpoint data that tracks process activity, and include th Older systems that support kerberos RC4 by default NetApp may generate false positives - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ Older systems that support kerberos RC4 by default NetApp may generate false pos + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md) diff --git a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md b/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md index 64669e7338..40b02fe9f1 100644 --- a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md +++ b/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md @@ -34,11 +34,14 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -78,7 +81,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ None identified. + #### Reference diff --git a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md b/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md index 44be3585a5..8e0b67f013 100644 --- a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md +++ b/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md @@ -34,11 +34,14 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -77,7 +80,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ None identified. + #### Reference diff --git a/docs/_posts/2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md b/docs/_posts/2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md index 3f9a566d73..1fd84f72ac 100644 --- a/docs/_posts/2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md +++ b/docs/_posts/2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md @@ -37,12 +37,18 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + | [T1555](https://attack.mitre.org/techniques/T1555/) | Credentials from Password Stores | Credential Access | + + #### Search ``` @@ -78,7 +84,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +92,7 @@ None identified. + #### Reference diff --git a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md b/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md index 43f5107674..55527f4e6b 100644 --- a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md +++ b/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md @@ -34,11 +34,14 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -77,7 +80,6 @@ You must be ingesting Windows Security logs from devices of interest, including Although unlikely, using debuggers this way may be indicative of developers analyzing crash dumps of their code. Note, even for developers this is an unusual way of working on code - debuggers are mostly used to step through code, not analyze its crash dumps. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ Although unlikely, using debuggers this way may be indicative of developers anal + #### Reference * [https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29](https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29) diff --git a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md b/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md index 6e199e61b5..f17b2a8df0 100644 --- a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md +++ b/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md @@ -34,11 +34,14 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -76,7 +79,6 @@ You must be ingesting Windows Security logs from devices of interest, including Although unlikely, using debuggers this way may be indicative of developers analyzing crash dumps of their code. Note, even for developers this is an unusual way of working on code - debuggers are mostly used to step through code, not analyze its crash dumps. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ Although unlikely, using debuggers this way may be indicative of developers anal + #### Reference diff --git a/docs/_posts/2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md b/docs/_posts/2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md index f5f648c5b5..52aac9d174 100644 --- a/docs/_posts/2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md +++ b/docs/_posts/2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md @@ -34,11 +34,14 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -76,7 +79,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ None identified. + #### Reference diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md index 12015f69df..cf0418070b 100644 --- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md +++ b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md @@ -34,11 +34,14 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -78,7 +81,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ None identified. + #### Reference * [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals) diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md index 67aaac4bc3..796ee37568 100644 --- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md +++ b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md @@ -34,11 +34,14 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -78,7 +81,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ None identified. + #### Reference * [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals) diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md index a6ba5aea9a..6cdc76c669 100644 --- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md +++ b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md @@ -34,11 +34,14 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -75,7 +78,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +86,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md index 4832fb8997..032e07fe84 100644 --- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md +++ b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md @@ -34,11 +34,14 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -75,7 +78,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +86,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-10-21-detect_kerberoasting.md b/docs/_posts/2020-10-21-detect_kerberoasting.md index ad7bdb92f9..653faaf139 100644 --- a/docs/_posts/2020-10-21-detect_kerberoasting.md +++ b/docs/_posts/2020-10-21-detect_kerberoasting.md @@ -1,6 +1,6 @@ --- title: "Detect Kerberoasting" -excerpt: "Kerberoasting" +excerpt: "Kerberoasting, Steal or Forge Kerberos Tickets" categories: - Endpoint last_modified_at: 2020-10-21 @@ -11,6 +11,9 @@ tags: - T1558.003 - Kerberoasting - Credential Access + - T1558 + - Steal or Forge Kerberos Tickets + - Credential Access - Splunk Behavioral Analytics - Actions on Objectives --- @@ -34,10 +37,17 @@ This search detects a potential kerberoasting attack via service principal name #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access | + +| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access | + + + + + #### Search ``` @@ -76,7 +86,6 @@ The test data is converted from Windows Security Event logs generated from Attac Older systems that support kerberos RC4 by default NetApp may generate false positives - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ Older systems that support kerberos RC4 by default NetApp may generate false pos + #### Reference * [Initial ESCU implementation by Jose Hernandez and Patrick Bareiss](Initial ESCU implementation by Jose Hernandez and Patrick Bareiss) diff --git a/docs/_posts/2020-10-21-detect_pass_the_hash.md b/docs/_posts/2020-10-21-detect_pass_the_hash.md index 389eb0646c..8d4aac8ad7 100644 --- a/docs/_posts/2020-10-21-detect_pass_the_hash.md +++ b/docs/_posts/2020-10-21-detect_pass_the_hash.md @@ -1,6 +1,6 @@ --- title: "Detect Pass the Hash" -excerpt: "Pass the Hash" +excerpt: "Use Alternate Authentication Material, Pass the Hash" categories: - Endpoint last_modified_at: 2020-10-21 @@ -8,6 +8,10 @@ toc: true toc_label: "" tags: - TTP + - T1550 + - Use Alternate Authentication Material + - Defense Evasion + - Lateral Movement - T1550.002 - Pass the Hash - Defense Evasion @@ -35,10 +39,17 @@ This search looks for specific authentication events from the Windows Security E #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1550](https://attack.mitre.org/techniques/T1550/) | Use Alternate Authentication Material | Defense Evasion, Lateral Movement | + + | [T1550.002](https://attack.mitre.org/techniques/T1550/002/) | Pass the Hash | Defense Evasion, Lateral Movement | + + + #### Search ``` @@ -79,7 +90,6 @@ The test data is converted from Windows Security Event logs generated from Attac Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +98,7 @@ Legitimate logon activity by authorized NTLM systems may be detected by this sea + #### Reference * [Initial ESCU implementation by Bhavin Patel and Patrick Bareiss](Initial ESCU implementation by Bhavin Patel and Patrick Bareiss) diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index f2abdf6db1..ba600a41dd 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -38,11 +38,14 @@ This search looks for commands that the SNICat tool uses in the TLS SNI field. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1041](https://attack.mitre.org/techniques/T1041/) | Exfiltration Over C2 Channel | Exfiltration | + + #### Search ``` @@ -88,6 +91,7 @@ Unknown + #### Reference * [https://www.mnemonic.no/blog/introducing-snicat/](https://www.mnemonic.no/blog/introducing-snicat/) diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index f85bd65eb2..6a89855118 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -1,6 +1,6 @@ --- title: "Detect IPv6 Network Infrastructure Threats" -excerpt: "Hardware Additions, Network Denial of Service, ARP Cache Poisoning" +excerpt: "Hardware Additions, Network Denial of Service, Man-in-the-Middle, ARP Cache Poisoning" categories: - Network last_modified_at: 2020-10-28 @@ -14,6 +14,10 @@ tags: - T1498 - Network Denial of Service - Impact + - T1557 + - Man-in-the-Middle + - Credential Access + - Collection - T1557.002 - ARP Cache Poisoning - Credential Access @@ -47,12 +51,25 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access | + + + | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | + + + +| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection | + + | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection | + + + #### Search ``` @@ -99,6 +116,7 @@ None currently known + #### Reference * [https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf](https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf) diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 515c59d108..fa8b8cf958 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -1,6 +1,6 @@ --- title: "Detect Port Security Violation" -excerpt: "Hardware Additions, Network Denial of Service, ARP Cache Poisoning" +excerpt: "Hardware Additions, Network Denial of Service, Man-in-the-Middle, ARP Cache Poisoning" categories: - Network last_modified_at: 2020-10-28 @@ -14,6 +14,10 @@ tags: - T1498 - Network Denial of Service - Impact + - T1557 + - Man-in-the-Middle + - Credential Access + - Collection - T1557.002 - ARP Cache Poisoning - Credential Access @@ -48,12 +52,25 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access | + + + | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | + + + +| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection | + + | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection | + + + #### Search ``` @@ -99,6 +116,7 @@ This search might be prone to high false positives if you have malfunctioning de + #### Reference diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 98f1c25a75..3d88c46829 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -1,6 +1,6 @@ --- title: "Detect Software Download To Network Device" -excerpt: "TFTP Boot" +excerpt: "TFTP Boot, Pre-OS Boot" categories: - Network last_modified_at: 2020-10-28 @@ -12,6 +12,10 @@ tags: - TFTP Boot - Defense Evasion - Persistence + - T1542 + - Pre-OS Boot + - Defense Evasion + - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +44,17 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1542.005](https://attack.mitre.org/techniques/T1542/005/) | TFTP Boot | Defense Evasion, Persistence | + +| [T1542](https://attack.mitre.org/techniques/T1542/) | Pre-OS Boot | Defense Evasion, Persistence | + + + + + #### Search ``` @@ -82,6 +93,7 @@ This search will also report any legitimate attempts of software downloads to ne + #### Reference diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index aa217e4911..eb08c79257 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -1,6 +1,6 @@ --- title: "Detect Traffic Mirroring" -excerpt: "Hardware Additions, Network Denial of Service, Traffic Duplication" +excerpt: "Hardware Additions, Automated Exfiltration, Network Denial of Service, Traffic Duplication" categories: - Network last_modified_at: 2020-10-28 @@ -11,6 +11,9 @@ tags: - T1200 - Hardware Additions - Initial Access + - T1020 + - Automated Exfiltration + - Exfiltration - T1498 - Network Denial of Service - Impact @@ -45,12 +48,25 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access | + + + +| [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration | + + + | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | + + | [T1020.001](https://attack.mitre.org/techniques/T1020/001/) | Traffic Duplication | Exfiltration | + + + #### Search ``` @@ -86,6 +102,7 @@ This search will return false positives for any legitimate traffic captures by n + #### Reference diff --git a/docs/_posts/2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md b/docs/_posts/2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md index 23b4f5daf6..3c171059e2 100644 --- a/docs/_posts/2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md @@ -74,21 +74,54 @@ This detection indicates use of Mimikatz modules that facilitate Pass-the-Token #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + + | [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation | + + + | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + + | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + | [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence | + + + | [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence | + + + | [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access | + + #### Search ``` @@ -123,7 +156,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -132,6 +164,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-11-03-applying_stolen_credentials_via_powersploit_modules.md b/docs/_posts/2020-11-03-applying_stolen_credentials_via_powersploit_modules.md index 39a3f70f27..4a0e56a9b8 100644 --- a/docs/_posts/2020-11-03-applying_stolen_credentials_via_powersploit_modules.md +++ b/docs/_posts/2020-11-03-applying_stolen_credentials_via_powersploit_modules.md @@ -72,21 +72,54 @@ Stolen credentials are applied by methods such as user impersonation, credential #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + + | [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation | + + + | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + + | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + | [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence | + + + | [T1555](https://attack.mitre.org/techniques/T1555/) | Credentials from Password Stores | Credential Access | + + + | [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access | + + #### Search ``` @@ -122,7 +155,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -131,6 +163,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md b/docs/_posts/2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md index 60f7de1d18..e7d4bcd670 100644 --- a/docs/_posts/2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md +++ b/docs/_posts/2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md @@ -52,16 +52,34 @@ This detection identifies use of DSInternals modules that verify password streng #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + + | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | + + + | [T1552](https://attack.mitre.org/techniques/T1552/) | Unsecured Credentials | Credential Access | + + + | [T1555](https://attack.mitre.org/techniques/T1555/) | Credentials from Password Stores | Credential Access | + + #### Search ``` @@ -97,7 +115,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -106,6 +123,7 @@ None identified. + #### Reference * [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals) diff --git a/docs/_posts/2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md b/docs/_posts/2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md index 39d95afda0..00f86585a1 100644 --- a/docs/_posts/2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md @@ -1,6 +1,6 @@ --- title: "Reconnaissance of Credential Stores and Services via Mimikatz modules" -excerpt: "Credentials, Domain Properties, Network Trust Dependencies, Exploitation for Privilege Escalation, Valid Accounts, Account Manipulation" +excerpt: "Account Manipulation, Domain Properties, Valid Accounts, Credentials, Gather Victim Network Information, Exploitation for Privilege Escalation, Gather Victim Identity Information, Network Trust Dependencies" categories: - Endpoint last_modified_at: 2020-11-03 @@ -8,27 +8,33 @@ toc: true toc_label: "" tags: - TTP - - T1589.001 - - Credentials - - Reconnaissance + - T1098 + - Account Manipulation + - Persistence - T1590.001 - Domain Properties - Reconnaissance - - T1590.003 - - Network Trust Dependencies - - Reconnaissance - - T1068 - - Exploitation for Privilege Escalation - - Privilege Escalation - T1078 - Valid Accounts - Defense Evasion - Persistence - Privilege Escalation - Initial Access - - T1098 - - Account Manipulation - - Persistence + - T1589.001 + - Credentials + - Reconnaissance + - T1590 + - Gather Victim Network Information + - Reconnaissance + - T1068 + - Exploitation for Privilege Escalation + - Privilege Escalation + - T1589 + - Gather Victim Identity Information + - Reconnaissance + - T1590.003 + - Network Trust Dependencies + - Reconnaissance - Splunk Behavioral Analytics - Actions on Objectives --- @@ -52,12 +58,38 @@ This detection identifies reconnaissance of credential stores and use of CryptoA #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1589.001](https://attack.mitre.org/techniques/T1589/001/) | Credentials | Reconnaissance || [T1590.001](https://attack.mitre.org/techniques/T1590/001/) | Domain Properties | Reconnaissance || [T1590.003](https://attack.mitre.org/techniques/T1590/003/) | Network Trust Dependencies | Reconnaissance || [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | -| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | +| ----------- | ----------- |--------------- | + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | +| [T1590.001](https://attack.mitre.org/techniques/T1590/001/) | Domain Properties | Reconnaissance | + + + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + +| [T1589.001](https://attack.mitre.org/techniques/T1589/001/) | Credentials | Reconnaissance | + + + +| [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance | + + + +| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + + +| [T1589](https://attack.mitre.org/techniques/T1589/) | Gather Victim Identity Information | Reconnaissance | + + +| [T1590.003](https://attack.mitre.org/techniques/T1590/003/) | Network Trust Dependencies | Reconnaissance | + + + + #### Search @@ -94,7 +126,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -103,6 +134,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md b/docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md index 3ae4e021cc..09e1c70564 100644 --- a/docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md +++ b/docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md @@ -43,13 +43,22 @@ This detection identifies illegal setting of credentials via DSInternals modules #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + #### Search ``` @@ -88,7 +97,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -97,6 +105,7 @@ None identified. + #### Reference * [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals) diff --git a/docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md b/docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md index eb4f5de639..2347e3c426 100644 --- a/docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md @@ -43,13 +43,22 @@ This detection identifies illegal setting of credentials via Mimikatz modules. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + #### Search ``` @@ -85,7 +94,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +102,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md b/docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md index e035e2e1a6..81a18c4bf3 100644 --- a/docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md +++ b/docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md @@ -43,13 +43,22 @@ This detection identifies illegal setting of credentials via PowerSploit modules #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + #### Search ``` @@ -85,7 +94,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +102,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md b/docs/_posts/2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md index 1a4db9abba..9bbc722120 100644 --- a/docs/_posts/2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md +++ b/docs/_posts/2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md @@ -40,12 +40,18 @@ This detection identifies use of PowerSploit modules that facilitate access prob #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + #### Search ``` @@ -81,7 +87,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +95,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md b/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md index 62a5c4a81e..f1cbbea968 100644 --- a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md @@ -44,13 +44,22 @@ This detection identifies use of Mimikatz modules for discovery of accounts and #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + | [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -86,7 +95,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +103,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md index ab50e886a3..9b81a645a1 100644 --- a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md @@ -44,13 +44,22 @@ This detection identifies access to PowerSploit modules that discover accounts, #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + | [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -86,7 +95,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +103,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md index bb05309a66..31f2cc453c 100644 --- a/docs/_posts/2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md @@ -58,16 +58,34 @@ This detection identifies use of PowerSploit modules that discover opportunities #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + + | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + | [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion | + + #### Search ``` @@ -103,7 +121,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -112,6 +129,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md index 2629b4a341..d3932a4390 100644 --- a/docs/_posts/2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md @@ -1,6 +1,6 @@ --- title: "Reconnaissance of Defensive Tools via PowerSploit modules" -excerpt: "Vulnerability Scanning, Software" +excerpt: "Software, Vulnerability Scanning, Gather Victim Host Information, Active Scanning" categories: - Endpoint last_modified_at: 2020-11-05 @@ -8,11 +8,17 @@ toc: true toc_label: "" tags: - TTP + - T1592.002 + - Software + - Reconnaissance - T1595.002 - Vulnerability Scanning - Reconnaissance - - T1592.002 - - Software + - T1592 + - Gather Victim Host Information + - Reconnaissance + - T1595 + - Active Scanning - Reconnaissance - Splunk Behavioral Analytics - Actions on Objectives @@ -37,8 +43,22 @@ This detection identifies use of PowerSploit modules for assessment of presence #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1595.002](https://attack.mitre.org/techniques/T1595/002/) | Vulnerability Scanning | Reconnaissance || [T1592.002](https://attack.mitre.org/techniques/T1592/002/) | Software | Reconnaissance | +| ----------- | ----------- |--------------- | +| [T1592.002](https://attack.mitre.org/techniques/T1592/002/) | Software | Reconnaissance | + + +| [T1595.002](https://attack.mitre.org/techniques/T1595/002/) | Vulnerability Scanning | Reconnaissance | + + + +| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | + + + +| [T1595](https://attack.mitre.org/techniques/T1595/) | Active Scanning | Reconnaissance | + + + #### Search @@ -76,7 +96,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +104,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md index 877afb4b8a..e3be182368 100644 --- a/docs/_posts/2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md @@ -43,13 +43,22 @@ This detection identifies use of PowerSploit modules for assessment of privilege #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + #### Search ``` @@ -85,7 +94,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +102,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md index 24732d28f2..e089ddcfca 100644 --- a/docs/_posts/2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md @@ -44,13 +44,22 @@ This detection identifies use of Mimikatz modules for discovery of process or se #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + + | [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion | + + #### Search ``` @@ -86,7 +95,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +103,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md index dd02ff9b3f..ba92a97e33 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md @@ -46,15 +46,30 @@ This detection identifies access to PowerSploit modules for reconnaissance and a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1199](https://attack.mitre.org/techniques/T1199/) | Trusted Relationship | Initial Access | + + + | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + + | [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance | + + + | [T1591](https://attack.mitre.org/techniques/T1591/) | Gather Victim Org Information | Reconnaissance | + + + | [T1595](https://attack.mitre.org/techniques/T1595/) | Active Scanning | Reconnaissance | + + #### Search ``` @@ -90,7 +105,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -99,6 +113,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md index 278d0bdc91..f7382d9b31 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md @@ -40,13 +40,22 @@ This detection identifies access to PowerSploit modules that discover computers, #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | + + + | [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance | + + + | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + #### Search ``` @@ -82,7 +91,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +99,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md index 316dc1ba0d..81045d65ff 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md @@ -34,11 +34,14 @@ This detection identifies use of Mimikatz modules for discovery of computers and #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | + + #### Search ``` @@ -74,7 +77,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md index cec9d87542..60c222183b 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md @@ -1,6 +1,6 @@ --- title: "Reconnaissance and Access to Operating System Elements via PowerSploit modules" -excerpt: "System Service Discovery, Query Registry, Network Service Scanning, Windows Management Instrumentation, Process Discovery, File and Directory Discovery, Software Discovery, Software" +excerpt: "Process Discovery, File and Directory Discovery, Software, Network Service Scanning, Query Registry, System Service Discovery, Windows Management Instrumentation, Gather Victim Host Information, Software Discovery" categories: - Endpoint last_modified_at: 2020-11-06 @@ -8,30 +8,33 @@ toc: true toc_label: "" tags: - TTP - - T1007 - - System Service Discovery - - Discovery - - T1012 - - Query Registry - - Discovery - - T1046 - - Network Service Scanning - - Discovery - - T1047 - - Windows Management Instrumentation - - Execution - T1057 - Process Discovery - Discovery - T1083 - File and Directory Discovery - Discovery - - T1518 - - Software Discovery - - Discovery - T1592.002 - Software - Reconnaissance + - T1046 + - Network Service Scanning + - Discovery + - T1012 + - Query Registry + - Discovery + - T1007 + - System Service Discovery + - Discovery + - T1047 + - Windows Management Instrumentation + - Execution + - T1592 + - Gather Victim Host Information + - Reconnaissance + - T1518 + - Software Discovery + - Discovery - Splunk Behavioral Analytics - Actions on Objectives --- @@ -55,17 +58,45 @@ This detection identifies access to PowerSploit modules that discover and access #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1007](https://attack.mitre.org/techniques/T1007/) | System Service Discovery | Discovery | -| [T1012](https://attack.mitre.org/techniques/T1012/) | Query Registry | Discovery | -| [T1046](https://attack.mitre.org/techniques/T1046/) | Network Service Scanning | Discovery | -| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | +| ----------- | ----------- |--------------- | + | [T1057](https://attack.mitre.org/techniques/T1057/) | Process Discovery | Discovery | + + + | [T1083](https://attack.mitre.org/techniques/T1083/) | File and Directory Discovery | Discovery | -| [T1518](https://attack.mitre.org/techniques/T1518/) | Software Discovery | Discovery | + + | [T1592.002](https://attack.mitre.org/techniques/T1592/002/) | Software | Reconnaissance | + +| [T1046](https://attack.mitre.org/techniques/T1046/) | Network Service Scanning | Discovery | + + + +| [T1012](https://attack.mitre.org/techniques/T1012/) | Query Registry | Discovery | + + + +| [T1007](https://attack.mitre.org/techniques/T1007/) | System Service Discovery | Discovery | + + + +| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | + + + +| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | + + + +| [T1518](https://attack.mitre.org/techniques/T1518/) | Software Discovery | Discovery | + + + + + #### Search ``` @@ -101,7 +132,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -110,6 +140,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md index 815870cb27..fdfa7dbc36 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md @@ -40,13 +40,22 @@ This detection identifies use of Mimikatz modules for discovery and access to se #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1007](https://attack.mitre.org/techniques/T1007/) | System Service Discovery | Discovery | + + + | [T1046](https://attack.mitre.org/techniques/T1046/) | Network Service Scanning | Discovery | + + + | [T1057](https://attack.mitre.org/techniques/T1057/) | Process Discovery | Discovery | + + #### Search ``` @@ -82,7 +91,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +99,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md index 3b6b05a2d5..105aa5a1a2 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md @@ -1,6 +1,6 @@ --- title: "Reconnaissance and Access to Shared Resources via Mimikatz modules" -excerpt: "SMB/Windows Admin Shares, Network Share Discovery, Data from Network Shared Drive" +excerpt: "Remote Services, Data from Network Shared Drive, Network Share Discovery, SMB/Windows Admin Shares" categories: - Endpoint last_modified_at: 2020-11-06 @@ -8,15 +8,18 @@ toc: true toc_label: "" tags: - TTP - - T1021.002 - - SMB/Windows Admin Shares + - T1021 + - Remote Services - Lateral Movement - - T1135 - - Network Share Discovery - - Discovery - T1039 - Data from Network Shared Drive - Collection + - T1135 + - Network Share Discovery + - Discovery + - T1021.002 + - SMB/Windows Admin Shares + - Lateral Movement - Splunk Behavioral Analytics - Actions on Objectives --- @@ -40,12 +43,25 @@ This detection identifies use of Mimikatz modules for discovery and access to ne #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement || [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery | +| ----------- | ----------- |--------------- | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + + | [T1039](https://attack.mitre.org/techniques/T1039/) | Data from Network Shared Drive | Collection | +| [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery | + + +| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | + + + + + #### Search ``` @@ -81,7 +97,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +105,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md index be82b6a29a..1dd26d3953 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md @@ -1,6 +1,6 @@ --- title: "Reconnaissance and Access to Shared Resources via PowerSploit modules" -excerpt: "SMB/Windows Admin Shares, Network Share Discovery, Data from Network Shared Drive" +excerpt: "Remote Services, Data from Network Shared Drive, Network Share Discovery, SMB/Windows Admin Shares" categories: - Endpoint last_modified_at: 2020-11-06 @@ -8,15 +8,18 @@ toc: true toc_label: "" tags: - TTP - - T1021.002 - - SMB/Windows Admin Shares + - T1021 + - Remote Services - Lateral Movement - - T1135 - - Network Share Discovery - - Discovery - T1039 - Data from Network Shared Drive - Collection + - T1135 + - Network Share Discovery + - Discovery + - T1021.002 + - SMB/Windows Admin Shares + - Lateral Movement - Splunk Behavioral Analytics - Actions on Objectives --- @@ -40,12 +43,25 @@ This detection identifies access to PowerSploit modules that discover and access #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement || [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery | +| ----------- | ----------- |--------------- | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + + | [T1039](https://attack.mitre.org/techniques/T1039/) | Data from Network Shared Drive | Collection | +| [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery | + + +| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | + + + + + #### Search ``` @@ -81,7 +97,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +105,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md index bea7096276..8ee1cbb36d 100644 --- a/docs/_posts/2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md @@ -1,6 +1,6 @@ --- title: "Reconnaissance of Connectivity via PowerSploit modules" -excerpt: "SMB/Windows Admin Shares, Network Share Discovery, Data from Network Shared Drive" +excerpt: "Remote Services, Data from Network Shared Drive, Network Share Discovery, SMB/Windows Admin Shares" categories: - Endpoint last_modified_at: 2020-11-06 @@ -8,15 +8,18 @@ toc: true toc_label: "" tags: - TTP - - T1021.002 - - SMB/Windows Admin Shares + - T1021 + - Remote Services - Lateral Movement - - T1135 - - Network Share Discovery - - Discovery - T1039 - Data from Network Shared Drive - Collection + - T1135 + - Network Share Discovery + - Discovery + - T1021.002 + - SMB/Windows Admin Shares + - Lateral Movement - Splunk Behavioral Analytics - Actions on Objectives --- @@ -40,12 +43,25 @@ This detection identifies access to PowerSploit modules for reconnaissance of co #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement || [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery | +| ----------- | ----------- |--------------- | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + + | [T1039](https://attack.mitre.org/techniques/T1039/) | Data from Network Shared Drive | Collection | +| [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery | + + +| [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | + + + + + #### Search ``` @@ -81,7 +97,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +105,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md index b9a79c6b11..a8e275c55a 100644 --- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md +++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md @@ -36,11 +36,14 @@ The search looks for files that contain the key word *Ryuk* under any folder in #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | + + #### Search ``` @@ -74,7 +77,6 @@ You must be ingesting data that records the filesystem activity from your hosts If there are files with this keywoord as file names it might trigger false possitives, please make use of our filters to tune out potential FPs. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ If there are files with this keywoord as file names it might trigger false possi + #### Reference diff --git a/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md index 12ca5e06eb..01d6ca5922 100644 --- a/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md +++ b/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md @@ -1,6 +1,6 @@ --- title: "Set Default PowerShell Execution Policy To Unrestricted or Bypass" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2020-11-06 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -38,10 +41,17 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "un #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -79,7 +89,6 @@ You must be ingesting data that records process activity from your hosts to popu Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should be reviewed and investigated as appropriate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ Administrators may attempt to change the default execution policy on a system fo + #### Reference diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md index 0cb9a5fa87..36036ff03f 100644 --- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md +++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md @@ -36,11 +36,14 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | + + #### Search ``` @@ -75,7 +78,6 @@ You must be ingesting data that records the process-system activity from your ho SAM is a critical windows service, stopping it would cause major issues on an endpoint this makes false positive rare. AlthoughNo false positives have been identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +86,7 @@ SAM is a critical windows service, stopping it would cause major issues on an en + #### Reference diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index 716154a133..59282b91bd 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -37,11 +37,14 @@ The search looks for file modifications with extensions commonly used by Ransomw #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | + + #### Search ``` @@ -85,7 +88,6 @@ Detailed documentation on how to create a new field within Incident Review may b It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +96,7 @@ It is possible for a legitimate file with these extensions to be created. If thi + #### Reference diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index f433947dfd..2b82394488 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -37,11 +37,14 @@ The search looks for files created with names matching those typically used in r #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | + + #### Search ``` @@ -80,7 +83,6 @@ You must be ingesting data that records file-system activity from your hosts to It's possible that a legitimate file could be created with the same name used by ransomware note files. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ It's possible that a legitimate file could be created with the same name use + #### Reference diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md index e6b909b9a0..4fa2a7d411 100644 --- a/docs/_posts/2020-11-09-deleting_shadow_copies.md +++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md @@ -37,11 +37,14 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | + + #### Search ``` @@ -86,7 +89,6 @@ You must be ingesting endpoint data that tracks process activity, including pare vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +97,7 @@ vssadmin.exe and wmic.exe are standard applications shipped with modern versions + #### Reference diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md index 1497ba7b73..d451dcb538 100644 --- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md +++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md @@ -1,6 +1,6 @@ --- title: "Detect Excessive Account Lockouts From Endpoint" -excerpt: "Domain Accounts" +excerpt: "Valid Accounts, Domain Accounts" categories: - Endpoint last_modified_at: 2020-11-09 @@ -8,6 +8,12 @@ toc: true toc_label: "" tags: - Anomaly + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - T1078.002 - Domain Accounts - Defense Evasion @@ -39,10 +45,17 @@ This search identifies endpoints that have caused a relatively high number of ac #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + | [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + #### Search ``` @@ -82,7 +95,6 @@ If Splunk>Phantom is also configured in your environment, a Playbook called & It's possible that a widely used system, such as a kiosk, could cause a large number of account lockouts. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +103,7 @@ It's possible that a widely used system, such as a kiosk, could cause a larg + #### Reference diff --git a/docs/_posts/2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md index 4623f3153c..3e16f69729 100644 --- a/docs/_posts/2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md +++ b/docs/_posts/2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md @@ -43,14 +43,26 @@ This detection identifies access to PowerSploit modules that enable illegaly acc #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + + | [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection | + + + | [T1123](https://attack.mitre.org/techniques/T1123/) | Audio Capture | Collection | + + + | [T1563](https://attack.mitre.org/techniques/T1563/) | Remote Service Session Hijacking | Lateral Movement | + + #### Search ``` @@ -86,7 +98,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +106,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-09-illegal_account_creation_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_account_creation_via_powersploit_modules.md index 1472c90b3b..0f0965c439 100644 --- a/docs/_posts/2020-11-09-illegal_account_creation_via_powersploit_modules.md +++ b/docs/_posts/2020-11-09-illegal_account_creation_via_powersploit_modules.md @@ -34,11 +34,14 @@ This detection identifies access to PowerSploit modules that create accounts ill #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1585](https://attack.mitre.org/techniques/T1585/) | Establish Accounts | Resource Development | + + #### Search ``` @@ -74,7 +77,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md b/docs/_posts/2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md index 6886b2e79d..92cad1d9c9 100644 --- a/docs/_posts/2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md @@ -34,11 +34,14 @@ This detection identifies access to PowerSploit modules that delete event logs. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + #### Search ``` @@ -74,7 +77,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md b/docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md index 552d7e71a8..8b8a0f9da1 100644 --- a/docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md +++ b/docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md @@ -40,12 +40,18 @@ This detection identifies use of DSInternals modules that enable or disable acco #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + #### Search ``` @@ -81,7 +87,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +95,7 @@ None identified. + #### Reference * [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals) diff --git a/docs/_posts/2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md b/docs/_posts/2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md index 8cd17d4133..f5f4410584 100644 --- a/docs/_posts/2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md +++ b/docs/_posts/2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md @@ -41,13 +41,22 @@ This detection identifies use of DSInternals modules for illegal management of A #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + + | [T1207](https://attack.mitre.org/techniques/T1207/) | Rogue Domain Controller | Defense Evasion | + + + | [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -83,7 +92,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +100,7 @@ None identified. + #### Reference * [https://github.com/MichaelGrafnetter/DSInternals](https://github.com/MichaelGrafnetter/DSInternals) diff --git a/docs/_posts/2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md index 6420b2124f..546fb5c689 100644 --- a/docs/_posts/2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md +++ b/docs/_posts/2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md @@ -41,13 +41,22 @@ This detection identifies access to PowerSploit modules that enable illegal mana #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + + | [T1207](https://attack.mitre.org/techniques/T1207/) | Rogue Domain Controller | Defense Evasion | + + + | [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -84,7 +93,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +101,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md index 7675b82eea..065d22cf3f 100644 --- a/docs/_posts/2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md +++ b/docs/_posts/2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md @@ -44,13 +44,22 @@ This detection identifies access to PowerSploit modules that illegaly elevate ge #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + + | [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation | + + + | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + #### Search ``` @@ -87,7 +96,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -96,6 +104,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md b/docs/_posts/2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md index b69a3f990f..75c9ba6f52 100644 --- a/docs/_posts/2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md @@ -39,12 +39,18 @@ This detection identifies use of Mimikatz modules for illegal privilege elevatio #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation | + + + | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + #### Search ``` @@ -80,7 +86,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +94,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md b/docs/_posts/2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md index 91cb0cca10..a9e4fa03e1 100644 --- a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md @@ -41,13 +41,22 @@ This detection identifies use of Mimikatz modules for illegal control over servi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + + | [T1106](https://attack.mitre.org/techniques/T1106/) | Native API | Execution | + + + | [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution | + + #### Search ``` @@ -83,7 +92,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +100,7 @@ None identified. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md index fa190f83ba..21cfd4f0c7 100644 --- a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md +++ b/docs/_posts/2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md @@ -41,13 +41,22 @@ This detection identifies access to PowerSploit modules that enable illegal cont #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + + | [T1106](https://attack.mitre.org/techniques/T1106/) | Native API | Execution | + + + | [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution | + + #### Search ``` @@ -85,7 +94,6 @@ You must be ingesting Windows Security logs from devices of interest, including None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +102,7 @@ None identified. + #### Reference * [https://github.com/PowerShellMafia/PowerSploit](https://github.com/PowerShellMafia/PowerSploit) diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index 53eaf1d1c4..a61dd05ba3 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -39,11 +39,14 @@ This search looks for fast execution of processes used for system network config #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1016](https://attack.mitre.org/techniques/T1016/) | System Network Configuration Discovery | Discovery | + + #### Search ``` @@ -91,7 +94,6 @@ You must be ingesting data that records registry activity from your hosts to pop It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -100,6 +102,7 @@ It is uncommon for normal users to execute a series of commands used for network + #### Reference diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index fade550c78..ac90a4c87a 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -1,6 +1,6 @@ --- title: "Detect Prohibited Applications Spawning cmd exe" -excerpt: "Windows Command Shell" +excerpt: "Command and Scripting Interpreter, Windows Command Shell" categories: - Endpoint last_modified_at: 2020-11-10 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.003 - Windows Command Shell - Execution @@ -37,10 +40,17 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | + + + #### Search ``` @@ -86,7 +96,6 @@ You must be ingesting data that records process activity from your hosts and pop There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. Investigate and modify the lookup file, as appropriate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +104,7 @@ There are circumstances where an application may legitimately execute and intera + #### Reference diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md index c16e985b56..bd37924825 100644 --- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md +++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md @@ -1,6 +1,6 @@ --- title: "Disabling Remote User Account Control" -excerpt: "Bypass User Account Control" +excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism" categories: - Endpoint last_modified_at: 2020-11-18 @@ -12,6 +12,10 @@ tags: - Bypass User Account Control - Privilege Escalation - Defense Evasion + - T1548 + - Abuse Elevation Control Mechanism + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +41,17 @@ The search looks for modifications to registry keys that control the enforcement #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | + +| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -77,7 +88,6 @@ To successfully implement this search, you must be ingesting data that records r This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +96,7 @@ This registry key may be modified via administrators to implement a change in sy + #### Reference diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md index cada006e31..413c3a875e 100644 --- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md +++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md @@ -1,6 +1,6 @@ --- title: "Execution of File with Multiple Extensions" -excerpt: "Rename System Utilities" +excerpt: "Masquerading, Rename System Utilities" categories: - Endpoint last_modified_at: 2020-11-18 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1036 + - Masquerading + - Defense Evasion - T1036.003 - Rename System Utilities - Defense Evasion @@ -37,10 +40,17 @@ This search looks for processes launched from files that have double extensions #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + + | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this search, you must be ingesting data that records p None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ None identified. + #### Reference diff --git a/docs/_posts/2020-11-23-monitor_registry_keys_for_print_monitors.md b/docs/_posts/2020-11-23-monitor_registry_keys_for_print_monitors.md index 6a3611b622..c5cda8cf66 100644 --- a/docs/_posts/2020-11-23-monitor_registry_keys_for_print_monitors.md +++ b/docs/_posts/2020-11-23-monitor_registry_keys_for_print_monitors.md @@ -1,6 +1,6 @@ --- title: "Monitor Registry Keys for Print Monitors" -excerpt: "Port Monitors" +excerpt: "Port Monitors, Boot or Logon Autostart Execution" categories: - Endpoint last_modified_at: 2020-11-23 @@ -12,6 +12,10 @@ tags: - Port Monitors - Persistence - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +41,17 @@ This search looks for registry activity associated with modifications to the reg #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1547.010](https://attack.mitre.org/techniques/T1547/010/) | Port Monitors | Persistence, Privilege Escalation | + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -76,7 +87,6 @@ To successfully implement this search, you must be ingesting data that records r You will encounter noise from legitimate print-monitor registry entries. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +95,7 @@ You will encounter noise from legitimate print-monitor registry entries. + #### Reference diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md index 61fda801af..d9df2335ab 100644 --- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md +++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md @@ -1,6 +1,6 @@ --- title: "Shim Database Installation With Suspicious Parameters" -excerpt: "Application Shimming" +excerpt: "Application Shimming, Event Triggered Execution" categories: - Endpoint last_modified_at: 2020-11-23 @@ -12,6 +12,10 @@ tags: - Application Shimming - Privilege Escalation - Persistence + - T1546 + - Event Triggered Execution + - Privilege Escalation + - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ This search detects the process execution and arguments required to silently cre #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1546.011](https://attack.mitre.org/techniques/T1546/011/) | Application Shimming | Privilege Escalation, Persistence | + +| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Privilege Escalation, Persistence | + + + + + #### Search ``` @@ -76,7 +87,6 @@ You must be ingesting data that records process activity from your hosts to popu None identified - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +95,7 @@ None identified + #### Reference diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md index d74d8c60ab..f692171044 100644 --- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md +++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md @@ -1,6 +1,6 @@ --- title: "Reg exe Manipulating Windows Services Registry Keys" -excerpt: "Services Registry Permissions Weakness" +excerpt: "Services Registry Permissions Weakness, Hijack Execution Flow" categories: - Endpoint last_modified_at: 2020-11-26 @@ -13,6 +13,11 @@ tags: - Persistence - Privilege Escalation - Defense Evasion + - T1574 + - Hijack Execution Flow + - Persistence + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +44,17 @@ The search looks for reg.exe modifying registry keys that define Windows service #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1574.011](https://attack.mitre.org/techniques/T1574/011/) | Services Registry Permissions Weakness | Persistence, Privilege Escalation, Defense Evasion | + +| [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -80,7 +92,6 @@ To successfully implement this search, you must be ingesting data that records r It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +100,7 @@ It is unusual for a service to be created or modified by directly manipulating t + #### Reference diff --git a/docs/_posts/2020-11-26-registry_keys_for_creating_shim_databases.md b/docs/_posts/2020-11-26-registry_keys_for_creating_shim_databases.md index 58d24d8968..c4e92bc51a 100644 --- a/docs/_posts/2020-11-26-registry_keys_for_creating_shim_databases.md +++ b/docs/_posts/2020-11-26-registry_keys_for_creating_shim_databases.md @@ -1,6 +1,6 @@ --- title: "Registry Keys for Creating SHIM Databases" -excerpt: "Application Shimming" +excerpt: "Application Shimming, Event Triggered Execution" categories: - Endpoint last_modified_at: 2020-11-26 @@ -12,6 +12,10 @@ tags: - Application Shimming - Privilege Escalation - Persistence + - T1546 + - Event Triggered Execution + - Privilege Escalation + - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +41,17 @@ This search looks for registry activity associated with application compatibilit #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1546.011](https://attack.mitre.org/techniques/T1546/011/) | Application Shimming | Privilege Escalation, Persistence | + +| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Privilege Escalation, Persistence | + + + + + #### Search ``` @@ -76,7 +87,6 @@ To successfully implement this search, you must populate the Change_Analysis dat There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +95,7 @@ There are many legitimate applications that leverage shim databases for compatib + #### Reference diff --git a/docs/_posts/2020-11-27-registry_keys_used_for_privilege_escalation.md b/docs/_posts/2020-11-27-registry_keys_used_for_privilege_escalation.md index f6cd226bba..9755266ef9 100644 --- a/docs/_posts/2020-11-27-registry_keys_used_for_privilege_escalation.md +++ b/docs/_posts/2020-11-27-registry_keys_used_for_privilege_escalation.md @@ -1,6 +1,6 @@ --- title: "Registry Keys Used For Privilege Escalation" -excerpt: "Image File Execution Options Injection" +excerpt: "Image File Execution Options Injection, Event Triggered Execution" categories: - Endpoint last_modified_at: 2020-11-27 @@ -12,6 +12,10 @@ tags: - Image File Execution Options Injection - Privilege Escalation - Persistence + - T1546 + - Event Triggered Execution + - Privilege Escalation + - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +41,17 @@ This search looks for modifications to registry keys that can be used to elevate #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1546.012](https://attack.mitre.org/techniques/T1546/012/) | Image File Execution Options Injection | Privilege Escalation, Persistence | + +| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Privilege Escalation, Persistence | + + + + + #### Search ``` @@ -77,7 +88,6 @@ To successfully implement this search, you must be ingesting data that records r There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +96,7 @@ There are many legitimate applications that must execute upon system startup and + #### Reference * [https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/](https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/) diff --git a/docs/_posts/2020-11-30-remote_process_instantiation_via_wmi.md b/docs/_posts/2020-11-30-remote_process_instantiation_via_wmi.md index ab054ccd62..a16369356b 100644 --- a/docs/_posts/2020-11-30-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2020-11-30-remote_process_instantiation_via_wmi.md @@ -37,11 +37,14 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | + + #### Search ``` @@ -84,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr The wmic.exe utility is a benign Windows application. It may be used legitimately by Administrators with these parameters for remote system administration, but it's relatively uncommon. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +95,7 @@ The wmic.exe utility is a benign Windows application. It may be used legitimatel + #### Reference diff --git a/docs/_posts/2020-11-30-rundll_loading_dll_by_ordinal.md b/docs/_posts/2020-11-30-rundll_loading_dll_by_ordinal.md index 60eff6d597..28c39e8ff0 100644 --- a/docs/_posts/2020-11-30-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2020-11-30-rundll_loading_dll_by_ordinal.md @@ -1,6 +1,6 @@ --- title: "RunDLL Loading DLL By Ordinal" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2020-11-30 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion @@ -37,10 +40,17 @@ This search looks for executing scripts with rundll32. Adversaries may abuse run #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr While not common, loading a DLL under %AppData% and calling a function by ordinal is possible by a legitimate process - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ While not common, loading a DLL under %AppData% and calling a function by ordina + #### Reference diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md index 4d627a2284..fb175569d8 100644 --- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md +++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md @@ -1,6 +1,6 @@ --- title: "Schtasks used for forcing a reboot" -excerpt: "Scheduled Task" +excerpt: "Scheduled Task, Scheduled Task/Job" categories: - Endpoint last_modified_at: 2020-12-07 @@ -13,6 +13,11 @@ tags: - Execution - Persistence - Privilege Escalation + - T1053 + - Scheduled Task/Job + - Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +44,17 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | + +| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -79,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators may create jobs on systems forcing reboots to perform updates, maintenance, etc. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +99,7 @@ Administrators may create jobs on systems forcing reboots to perform updates, ma + #### Reference diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md index ee52a6cf26..4a5e79531e 100644 --- a/docs/_posts/2020-12-08-shim_database_file_creation.md +++ b/docs/_posts/2020-12-08-shim_database_file_creation.md @@ -1,6 +1,6 @@ --- title: "Shim Database File Creation" -excerpt: "Application Shimming" +excerpt: "Application Shimming, Event Triggered Execution" categories: - Endpoint last_modified_at: 2020-12-08 @@ -12,6 +12,10 @@ tags: - Application Shimming - Privilege Escalation - Persistence + - T1546 + - Event Triggered Execution + - Privilege Escalation + - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +41,17 @@ This search looks for shim database files being written to default directories. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1546.011](https://attack.mitre.org/techniques/T1546/011/) | Application Shimming | Privilege Escalation, Persistence | + +| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Privilege Escalation, Persistence | + + + + + #### Search ``` @@ -75,7 +86,6 @@ You must be ingesting data that records the filesystem activity from your hosts Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +94,7 @@ Because legitimate shim files are created and used all the time, this event, in + #### Reference diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md index b33105830f..2fe9af28f7 100644 --- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md +++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md @@ -1,6 +1,6 @@ --- title: "Single Letter Process On Endpoint" -excerpt: "Malicious File" +excerpt: "User Execution, Malicious File" categories: - Endpoint last_modified_at: 2020-12-08 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1204 + - User Execution + - Execution - T1204.002 - Malicious File - Execution @@ -37,10 +40,17 @@ This search looks for process names that consist only of a single letter. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + | [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution | + + + #### Search ``` @@ -78,7 +88,6 @@ You must be ingesting data that records process activity from your hosts to popu Single-letter executables are not always malicious. Investigate this activity with your normal incident-response process. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ Single-letter executables are not always malicious. Investigate this activity wi + #### Reference diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index e20621be76..e712dc7b68 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -1,6 +1,6 @@ --- title: "System Processes Run From Unexpected Locations" -excerpt: "Rename System Utilities" +excerpt: "Masquerading, Rename System Utilities" categories: - Endpoint last_modified_at: 2020-12-08 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1036 + - Masquerading + - Defense Evasion - T1036.003 - Rename System Utilities - Defense Evasion @@ -39,10 +42,17 @@ During triage, review the parallel processes - what process moved the native Win #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + + | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | + + + #### Search ``` @@ -84,7 +94,6 @@ To successfully implement this search you need to be ingesting information on pr This detection may require tuning based on third party applications utilizing native Windows binaries in non-standard paths. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ This detection may require tuning based on third party applications utilizing na + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml) diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md index 7f7f409156..d057cb5c29 100644 --- a/docs/_posts/2020-12-08-unusually_long_command_line.md +++ b/docs/_posts/2020-12-08-unusually_long_command_line.md @@ -73,7 +73,6 @@ You must be ingesting endpoint data that tracks process activity, including pare Some legitimate applications start with long command lines. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -82,6 +81,7 @@ Some legitimate applications start with long command lines. + #### Reference diff --git a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md index e526e78208..e7666e1edf 100644 --- a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md +++ b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md @@ -1,6 +1,6 @@ --- title: "WMI Permanent Event Subscription - Sysmon" -excerpt: "Windows Management Instrumentation Event Subscription" +excerpt: "Windows Management Instrumentation Event Subscription, Event Triggered Execution" categories: - Endpoint last_modified_at: 2020-12-08 @@ -12,6 +12,10 @@ tags: - Windows Management Instrumentation Event Subscription - Privilege Escalation - Persistence + - T1546 + - Event Triggered Execution + - Privilege Escalation + - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -42,10 +46,17 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1546.003](https://attack.mitre.org/techniques/T1546/003/) | Windows Management Instrumentation Event Subscription | Privilege Escalation, Persistence | + +| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Privilege Escalation, Persistence | + + + + + #### Search ``` @@ -82,7 +93,6 @@ To successfully implement this search, you must be collecting Sysmon data using Although unlikely, administrators may use event subscriptions for legitimate purposes. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +101,7 @@ Although unlikely, administrators may use event subscriptions for legitimate pur + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md) diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index d66f459e63..5d395afe9b 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -38,11 +38,14 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution | + + #### Search ``` @@ -80,6 +83,7 @@ unknown + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html](https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html) diff --git a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md index 8823e1be3e..4234cbb440 100644 --- a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md +++ b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md @@ -1,6 +1,6 @@ --- title: "O365 Suspicious Rights Delegation" -excerpt: "Remote Email Collection" +excerpt: "Remote Email Collection, Email Collection" categories: - Cloud last_modified_at: 2020-12-15 @@ -11,6 +11,9 @@ tags: - T1114.002 - Remote Email Collection - Collection + - T1114 + - Email Collection + - Collection - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ This search detects the assignment of rights to accesss content from another mai #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection | + +| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | + + + + + #### Search ``` @@ -75,7 +85,6 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 Service Accounts - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ Service Accounts + #### Reference diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index 85acdf5bc4..c03c3a30d6 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -1,6 +1,6 @@ --- title: "High Number of Login Failures from a single source" -excerpt: "Password Guessing" +excerpt: "Password Guessing, Brute Force" categories: - Cloud last_modified_at: 2020-12-16 @@ -11,6 +11,9 @@ tags: - T1110.001 - Password Guessing - Credential Access + - T1110 + - Brute Force + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +41,17 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1110.001](https://attack.mitre.org/techniques/T1110/001/) | Password Guessing | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + + + + + #### Search ``` @@ -82,6 +92,7 @@ unknown + #### Reference diff --git a/docs/_posts/2020-12-16-o365_disable_mfa.md b/docs/_posts/2020-12-16-o365_disable_mfa.md index 2354b6f646..91c9472a99 100644 --- a/docs/_posts/2020-12-16-o365_disable_mfa.md +++ b/docs/_posts/2020-12-16-o365_disable_mfa.md @@ -39,11 +39,14 @@ This search detects when multi factor authentication has been disabled, what ent #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence | + + #### Search ``` @@ -80,7 +83,6 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 Unless it is a special case, it is uncommon to disable MFA or Strong Authentication - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ Unless it is a special case, it is uncommon to disable MFA or Strong Authenticat + #### Reference * [https://attack.mitre.org/techniques/T1556/](https://attack.mitre.org/techniques/T1556/) diff --git a/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md b/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md index ec87d7a284..baa223ca04 100644 --- a/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md +++ b/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md @@ -37,11 +37,14 @@ This search detects when an excessive number of authentication failures occur th #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + + #### Search ``` @@ -78,7 +81,6 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 The threshold for alert is above 10 attempts and this should reduce the number of false positives. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ The threshold for alert is above 10 attempts and this should reduce the number o + #### Reference * [https://attack.mitre.org/techniques/T1110/](https://attack.mitre.org/techniques/T1110/) diff --git a/docs/_posts/2020-12-16-o365_pst_export_alert.md b/docs/_posts/2020-12-16-o365_pst_export_alert.md index 7c12971fd6..32c05ee1b0 100644 --- a/docs/_posts/2020-12-16-o365_pst_export_alert.md +++ b/docs/_posts/2020-12-16-o365_pst_export_alert.md @@ -37,11 +37,14 @@ This search detects when a user has performed an Ediscovery search or exported a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | + + #### Search ``` @@ -78,7 +81,6 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ PST export can be done for legitimate purposes but due to the sensitive nature o + #### Reference * [https://attack.mitre.org/techniques/T1114/](https://attack.mitre.org/techniques/T1114/) diff --git a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md index 00b582f383..16efc321b4 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md @@ -1,6 +1,6 @@ --- title: "O365 Suspicious Admin Email Forwarding" -excerpt: "Email Forwarding Rule" +excerpt: "Email Forwarding Rule, Email Collection" categories: - Cloud last_modified_at: 2020-12-16 @@ -11,6 +11,9 @@ tags: - T1114.003 - Email Forwarding Rule - Collection + - T1114 + - Email Collection + - Collection - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ This search detects when an admin configured a forwarding rule for multiple mail #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1114.003](https://attack.mitre.org/techniques/T1114/003/) | Email Forwarding Rule | Collection | + +| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | + + + + + #### Search ``` @@ -77,7 +87,6 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ unknown + #### Reference diff --git a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md index c8f655f2ab..8e21f41e1e 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md @@ -1,6 +1,6 @@ --- title: "O365 Suspicious User Email Forwarding" -excerpt: "Email Forwarding Rule" +excerpt: "Email Forwarding Rule, Email Collection" categories: - Cloud last_modified_at: 2020-12-16 @@ -11,6 +11,9 @@ tags: - T1114.003 - Email Forwarding Rule - Collection + - T1114 + - Email Collection + - Collection - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ This search detects when multiple user configured a forwarding rule to the same #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1114.003](https://attack.mitre.org/techniques/T1114/003/) | Email Forwarding Rule | Collection | + +| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | + + + + + #### Search ``` @@ -77,7 +87,6 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ unknown + #### Reference diff --git a/docs/_posts/2020-12-16-windows_adfind_exe.md b/docs/_posts/2020-12-16-windows_adfind_exe.md index 969139b545..524fcc4571 100644 --- a/docs/_posts/2020-12-16-windows_adfind_exe.md +++ b/docs/_posts/2020-12-16-windows_adfind_exe.md @@ -39,11 +39,14 @@ This search looks for the execution of `adfind.exe` with command-line arguments #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -84,6 +87,7 @@ administrators rarely use adfind, usually not used for legitimate reasons + #### Reference * [https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/](https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/) diff --git a/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md index 9a98f0209e..7b78edc13a 100644 --- a/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md +++ b/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md @@ -1,6 +1,6 @@ --- title: "Scheduled Task Deleted Or Created via CMD" -excerpt: "Scheduled Task" +excerpt: "Scheduled Task, Scheduled Task/Job" categories: - Endpoint last_modified_at: 2020-12-17 @@ -13,6 +13,11 @@ tags: - Execution - Persistence - Privilege Escalation + - T1053 + - Scheduled Task/Job + - Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +44,17 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | + +| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -80,7 +92,6 @@ You must be ingesting endpoint data that tracks process activity, including pare Tasks should not be manually created via CLI, this is rarely done by admins as well - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +100,7 @@ Tasks should not be manually created via CLI, this is rarely done by admins as w + #### Reference diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md index 781e600e70..cbe456a150 100644 --- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md +++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md @@ -37,11 +37,14 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | + + #### Search ``` @@ -78,7 +81,6 @@ You must be ingesting endpoint data that tracks process activity, including pare Administrators may modify the boot configuration. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ Administrators may modify the boot configuration. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair) diff --git a/docs/_posts/2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md index f6dce104ae..32dcbb1695 100644 --- a/docs/_posts/2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md @@ -34,11 +34,14 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -75,7 +78,6 @@ You must be ingesting windows endpoint data that tracks process activity, includ None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +86,7 @@ None identified. + #### Reference * [https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml](https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml) diff --git a/docs/_posts/2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md index 7dc5d932ed..c732dc2bcc 100644 --- a/docs/_posts/2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md @@ -34,11 +34,14 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + #### Search ``` @@ -82,7 +85,6 @@ You must be ingesting sysmon logs. This search has been modified to process raw There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. Investigate and modify the lookup file, as appropriate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ There are circumstances where an application may legitimately execute and intera + #### Reference diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index 9bce681c30..ca45356aa8 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -39,10 +39,13 @@ This search aims to detect the Supernova webshell used in the SUNBURST attack. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence | + + + #### Search ``` @@ -78,6 +81,7 @@ There might be false positives associted with this detection since items like ar + #### Reference * [https://www.splunk.com/en_us/blog/security/detecting-supernova-malware-solarwinds-continued.html](https://www.splunk.com/en_us/blog/security/detecting-supernova-malware-solarwinds-continued.html) diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md index 875b597a11..5a41c70e81 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md +++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md @@ -36,11 +36,14 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | + + #### Search ``` @@ -82,7 +85,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ unknown + #### Reference * [https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/) diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md index 96258f7f29..1b43357116 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md +++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md @@ -36,11 +36,14 @@ This search provides detection of users with KMS keys performing encryption spec #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | + + #### Search ``` @@ -77,7 +80,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit bucket with S3 encryption - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ bucket with S3 encryption + #### Reference * [https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/) diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md index 6ddf3dd376..34a01b9a81 100644 --- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md +++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md @@ -1,6 +1,6 @@ --- title: "AWS Network Access Control List Created with All Open Ports" -excerpt: "Disable or Modify Cloud Firewall" +excerpt: "Disable or Modify Cloud Firewall, Impair Defenses" categories: - Cloud last_modified_at: 2021-01-11 @@ -11,6 +11,9 @@ tags: - T1562.007 - Disable or Modify Cloud Firewall - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -84,7 +94,6 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add- It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ It's possible that an admin has created this ACL with all ports open for som + #### Reference diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md index 8a27162491..f22c6bbc2a 100644 --- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md +++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md @@ -1,6 +1,6 @@ --- title: "AWS Network Access Control List Deleted" -excerpt: "Disable or Modify Cloud Firewall" +excerpt: "Disable or Modify Cloud Firewall, Impair Defenses" categories: - Cloud last_modified_at: 2021-01-12 @@ -11,6 +11,9 @@ tags: - T1562.007 - Disable or Modify Cloud Firewall - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -77,7 +87,6 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add- It's possible that a user has legitimately deleted a network ACL. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ It's possible that a user has legitimately deleted a network ACL. + #### Reference diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index 11d8e38417..584296b60b 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -37,11 +37,14 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, limited instances have been identified coming from native Microsoft utilities similar to SCCM. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ Although unlikely, limited instances have been identified coming from native Mic + #### Reference * [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/) diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_path.md b/docs/_posts/2021-01-12-suspicious_msbuild_path.md index 87cdaba494..1e5d9e6beb 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_path.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_path.md @@ -1,6 +1,6 @@ --- title: "Suspicious msbuild path" -excerpt: "MSBuild, Rename System Utilities" +excerpt: "Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities, MSBuild" categories: - Endpoint last_modified_at: 2021-01-12 @@ -8,12 +8,18 @@ toc: true toc_label: "" tags: - TTP - - T1127.001 - - MSBuild + - T1036 + - Masquerading + - Defense Evasion + - T1127 + - Trusted Developer Utilities Proxy Execution - Defense Evasion - T1036.003 - Rename System Utilities - Defense Evasion + - T1127.001 + - MSBuild + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,8 +46,22 @@ The following analytic identifies msbuild.exe executing from a non-standard path #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion || [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | +| ----------- | ----------- |--------------- | + +| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + + + +| [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion | + + +| [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | + + +| [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion | + + + #### Search @@ -87,7 +107,6 @@ To successfully implement this search you need to be ingesting information on pr Some legitimate applications may use a moved copy of msbuild.exe, triggering a false positive. Baselining of MSBuild.exe usage is recommended to better understand it's path usage. Visual Studio runs an instance out of a path that will need to be filtered on. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -96,6 +115,7 @@ Some legitimate applications may use a moved copy of msbuild.exe, triggering a f + #### Reference * [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/) diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md index d5a941f14c..e1531ee1d6 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md @@ -1,6 +1,6 @@ --- title: "Suspicious MSBuild Rename" -excerpt: "MSBuild, Rename System Utilities" +excerpt: "Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities, MSBuild" categories: - Endpoint last_modified_at: 2021-01-12 @@ -8,12 +8,18 @@ toc: true toc_label: "" tags: - TTP - - T1127.001 - - MSBuild + - T1036 + - Masquerading + - Defense Evasion + - T1127 + - Trusted Developer Utilities Proxy Execution - Defense Evasion - T1036.003 - Rename System Utilities - Defense Evasion + - T1127.001 + - MSBuild + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,8 +46,22 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion || [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | +| ----------- | ----------- |--------------- | + +| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + + + +| [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion | + + +| [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | + + +| [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion | + + + #### Search @@ -87,7 +107,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may use a moved copy of msbuild, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -96,6 +115,7 @@ Although unlikely, some legitimate applications may use a moved copy of msbuild, + #### Reference * [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/) diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index fb446a3d9d..5e0163da94 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -1,6 +1,6 @@ --- title: "Suspicious MSBuild Spawn" -excerpt: "MSBuild" +excerpt: "Trusted Developer Utilities Proxy Execution, MSBuild" categories: - Endpoint last_modified_at: 2021-01-12 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1127 + - Trusted Developer Utilities Proxy Execution + - Defense Evasion - T1127.001 - MSBuild - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion | + + | [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg + #### Reference * [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/) diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md index b564d621b6..53d9bd4bc0 100644 --- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md +++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md @@ -1,6 +1,6 @@ --- title: "Suspicious mshta child process" -excerpt: "Mshta" +excerpt: "Signed Binary Proxy Execution, Mshta" categories: - Endpoint last_modified_at: 2021-01-12 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.005 - Mshta - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies child processes spawning from "mshta.exe& #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | + + + #### Search ``` @@ -77,7 +87,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg + #### Reference * [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses) diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index 0ed3f29277..6e40ca2c9a 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -38,11 +38,14 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1189](https://attack.mitre.org/techniques/T1189/) | Drive-by Compromise | Initial Access | + + #### Search ``` @@ -88,7 +91,6 @@ Detailed documentation on how to create a new field within Incident Review may b Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -97,6 +99,7 @@ Some users and applications may leverage Dynamic DNS to reach out to some domain + #### Reference diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index ed5582c236..4b1b4e93b8 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -1,6 +1,6 @@ --- title: "Malicious PowerShell Process With Obfuscation Techniques" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2021-01-19 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -38,10 +41,17 @@ This search looks for PowerShell processes launched with arguments that have cha #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -86,7 +96,6 @@ To successfully implement this search you need to be ingesting information on pr These characters might be legitimately on the command-line, but it is not common. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +104,7 @@ These characters might be legitimately on the command-line, but it is not common + #### Reference diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index 2830d99230..606bd68b67 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -1,6 +1,6 @@ --- title: "Detect Rundll32 Inline HTA Execution" -excerpt: "Mshta" +excerpt: "Signed Binary Proxy Execution, Mshta" categories: - Endpoint last_modified_at: 2021-01-20 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.005 - Mshta - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies "rundll32.exe" execution with inline p #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg + #### Reference * [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses) diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index 354669dcc1..ce99ef519e 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -1,6 +1,6 @@ --- title: "Suspicious mshta spawn" -excerpt: "Mshta" +excerpt: "Signed Binary Proxy Execution, Mshta" categories: - Endpoint last_modified_at: 2021-01-20 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.005 - Mshta - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg + #### Reference * [https://codewhitesec.blogspot.com/2018/07/lethalhta.html](https://codewhitesec.blogspot.com/2018/07/lethalhta.html) diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md index 6c120d439e..4b4124c259 100644 --- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md +++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md @@ -37,11 +37,14 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | + + #### Search ``` @@ -78,7 +81,6 @@ You must be ingesting endpoint data that tracks process activity, including pare Administrators may modify the boot configuration. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ Administrators may modify the boot configuration. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md) diff --git a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md index 167dfcdf1e..4f70093023 100644 --- a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md +++ b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md @@ -37,11 +37,14 @@ This search looks for the execution of `nltest.exe` with command-line arguments #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators may use nltest for troubleshooting purposes, otherwise, rarely used. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators may use nltest for troubleshooting purposes, otherwise, rarely us + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md) diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md index 0befc7e4d5..ff4e62590d 100644 --- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md +++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md @@ -39,11 +39,14 @@ This search provides specific SAML access from specific Service Provider, user a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -80,7 +83,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very diff + #### Reference * [https://us-cert.cisa.gov/ncas/alerts/aa21-008a](https://us-cert.cisa.gov/ncas/alerts/aa21-008a) diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md index 5619293978..c1aa23bfcf 100644 --- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md +++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md @@ -39,11 +39,14 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + #### Search ``` @@ -79,7 +82,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ Updating a SAML provider or creating a new one may not necessarily be malicious + #### Reference * [https://us-cert.cisa.gov/ncas/alerts/aa21-008a](https://us-cert.cisa.gov/ncas/alerts/aa21-008a) diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md index 22c65bb9c7..dcfd834fe1 100644 --- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md +++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md @@ -73,7 +73,6 @@ To successfully implement this search you need to be ingesting information on pr Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -82,6 +81,7 @@ Unless there are specific use cases, manipulating or exporting certificates usin + #### Reference diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md index 1e3c41af88..dba9e3a747 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md @@ -70,7 +70,6 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add- None - #### RBA | Risk Score | Impact | Confidence | Message | @@ -79,6 +78,7 @@ None + #### Reference diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index 38a870194f..f56633d6ce 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -70,6 +70,7 @@ None + #### Reference diff --git a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md index f49e72aa89..6932d670c3 100644 --- a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md +++ b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md @@ -1,6 +1,6 @@ --- title: "O365 Add App Role Assignment Grant User" -excerpt: "Cloud Account" +excerpt: "Cloud Account, Create Account" categories: - Cloud last_modified_at: 2021-01-26 @@ -11,6 +11,9 @@ tags: - T1136.003 - Cloud Account - Persistence + - T1136 + - Create Account + - Persistence - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ This search detects the creation of a new Federation setting by alerting about a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | + +| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | + + + + + #### Search ``` @@ -78,7 +88,6 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ The creation of a new Federation is not necessarily malicious, however this even + #### Reference * [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf) diff --git a/docs/_posts/2021-01-26-o365_added_service_principal.md b/docs/_posts/2021-01-26-o365_added_service_principal.md index 18de310435..8906f28d27 100644 --- a/docs/_posts/2021-01-26-o365_added_service_principal.md +++ b/docs/_posts/2021-01-26-o365_added_service_principal.md @@ -1,6 +1,6 @@ --- title: "O365 Added Service Principal" -excerpt: "Cloud Account" +excerpt: "Cloud Account, Create Account" categories: - Cloud last_modified_at: 2021-01-26 @@ -11,6 +11,9 @@ tags: - T1136.003 - Cloud Account - Persistence + - T1136 + - Create Account + - Persistence - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ This search detects the creation of a new Federation setting by alerting about a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | + +| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | + + + + + #### Search ``` @@ -78,7 +88,6 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ The creation of a new Federation is not necessarily malicious, however these eve + #### Reference * [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf) diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md index edda2c8b31..b67e5280db 100644 --- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md +++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md @@ -39,11 +39,14 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence | + + #### Search ``` @@ -80,7 +83,6 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ Logon errors may not be malicious in nature however it may indicate attempts to + #### Reference * [https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/](https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/) diff --git a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md index 5f4b48e76b..47f86945b8 100644 --- a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md +++ b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md @@ -1,6 +1,6 @@ --- title: "O365 New Federated Domain Added" -excerpt: "Cloud Account" +excerpt: "Cloud Account, Create Account" categories: - Cloud last_modified_at: 2021-01-26 @@ -11,6 +11,9 @@ tags: - T1136.003 - Cloud Account - Persistence + - T1136 + - Create Account + - Persistence - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ This search detects the addition of a new Federated domain. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | + +| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | + + + + + #### Search ``` @@ -79,7 +89,6 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ The creation of a new Federated domain is not necessarily malicious, however the + #### Reference * [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf) diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index 77b321653c..28aadc1156 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-3156 - Exploitation --- @@ -38,11 +39,14 @@ This search detects the heap-based buffer overflow of sudoedit #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + #### Search ``` @@ -72,6 +76,14 @@ unknown +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 | + + + #### Reference * [https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit](https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit) diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index 03d23a7ee3..42ac2599b9 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-3156 - Exploitation --- @@ -38,11 +39,14 @@ This search detects the heap-based buffer overflow of sudoedit #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + #### Search ``` @@ -73,6 +77,14 @@ unknown +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 | + + + #### Reference * [https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit](https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit) diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index 9ac328538b..624e0e4270 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -1,6 +1,6 @@ --- title: "Detect Regsvr32 Application Control Bypass" -excerpt: "Regsvr32" +excerpt: "Signed Binary Proxy Execution, Regsvr32" categories: - Endpoint last_modified_at: 2021-01-28 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.010 - Regsvr32 - Defense Evasion @@ -38,10 +41,17 @@ Upon investigating, look for network connections to remote destinations (interna #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | + + + #### Search ``` @@ -84,7 +94,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives related to third party software registering .DLL's. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ Limited false positives related to third party software registering .DLL's. + #### Reference * [https://attack.mitre.org/techniques/T1218/010/](https://attack.mitre.org/techniques/T1218/010/) diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md index 7f73989521..03a6159246 100644 --- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md +++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md @@ -1,6 +1,6 @@ --- title: "Ntdsutil Export NTDS" -excerpt: "NTDS" +excerpt: "NTDS, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-01-28 @@ -11,6 +11,9 @@ tags: - T1003.003 - NTDS - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +42,17 @@ This technique uses "Install from Media" (IFM), which will extract a cop #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -81,7 +91,6 @@ You must be ingesting endpoint data that tracks process activity, including pare Highly possible Server Administrators will troubleshoot with ntdsutil.exe, generating false positives. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ Highly possible Server Administrators will troubleshoot with ntdsutil.exe, gener + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil) diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index b585c7f7c5..99d130ad1e 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -1,6 +1,6 @@ --- title: "Suspicious Regsvr32 Register Suspicious Path" -excerpt: "Regsvr32" +excerpt: "Signed Binary Proxy Execution, Regsvr32" categories: - Endpoint last_modified_at: 2021-01-28 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.010 - Regsvr32 - Defense Evasion @@ -37,10 +40,17 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | + + + #### Search ``` @@ -83,7 +93,6 @@ You must be ingesting endpoint data that tracks process activity, including pare Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ Limited false positives with the query restricted to specified paths. Add more w + #### Reference * [https://attack.mitre.org/techniques/T1218/010/](https://attack.mitre.org/techniques/T1218/010/) diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index 4c191ec47d..56a4e900ad 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-3156 - Exploitation --- @@ -38,11 +39,14 @@ This search detects the heap-based buffer overflow of sudoedit #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + #### Search ``` @@ -75,6 +79,14 @@ If sudoedit is throwing segfaults for other reasons this will pick those up too. +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 | + + + #### Reference * [https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit](https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit) diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index ffcbe58e76..1828d60b45 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -1,6 +1,6 @@ --- title: "Detect Rundll32 Application Control Bypass - advpack" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-02-04 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may use advpack.dll or ieadvpack.dll, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Although unlikely, some legitimate applications may use advpack.dll or ieadvpack + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index 5c5cda21a2..3750409611 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -1,6 +1,6 @@ --- title: "Detect Rundll32 Application Control Bypass - setupapi" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-02-04 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may use setupapi triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Although unlikely, some legitimate applications may use setupapi triggering a fa + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index 50eb744557..86910920e3 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -1,6 +1,6 @@ --- title: "Detect Rundll32 Application Control Bypass - syssetup" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-02-04 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may use syssetup.dll, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Although unlikely, some legitimate applications may use syssetup.dll, triggering + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_rename.md b/docs/_posts/2021-02-04-suspicious_rundll32_rename.md index 8b9daf3fd8..93e6034168 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_rename.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_rename.md @@ -1,6 +1,6 @@ --- title: "Suspicious Rundll32 Rename" -excerpt: "Rundll32, Rename System Utilities" +excerpt: "Signed Binary Proxy Execution, Masquerading, Rundll32, Rename System Utilities" categories: - Endpoint last_modified_at: 2021-02-04 @@ -8,6 +8,12 @@ toc: true toc_label: "" tags: - Hunting + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion + - T1036 + - Masquerading + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion @@ -40,8 +46,22 @@ The following analytic identifies renamed instances of rundll32.exe executing. r #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion || [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + + +| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + + +| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + +| [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | + + + #### Search @@ -86,7 +106,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +114,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index 9158d38fc4..ae9f0b1ad5 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -1,6 +1,6 @@ --- title: "Suspicious Rundll32 StartW" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-02-04 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies rundll32.exe executing a DLL function name, St #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -84,7 +94,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ Although unlikely, some legitimate applications may use Start as a function and + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index 1bd08b9949..6aef9b252f 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -1,6 +1,6 @@ --- title: "Suspicious Rundll32 dllregisterserver" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-02-09 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr This is likely to produce false positives and will require some filtering. Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ This is likely to produce false positives and will require some filtering. Tune + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md index fc9e5f1271..47d94bbf54 100644 --- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md +++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md @@ -1,6 +1,6 @@ --- title: "Detect HTML Help Spawn Child Process" -excerpt: "Compiled HTML File" +excerpt: "Signed Binary Proxy Execution, Compiled HTML File" categories: - Endpoint last_modified_at: 2021-02-11 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.001 - Compiled HTML File - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Although unlikely, some legitimate applications (ex. web browsers) may spawn a c + #### Reference * [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/) diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md index 188f709d39..a6a3277bfc 100644 --- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md @@ -1,6 +1,6 @@ --- title: "Detect Regasm Spawning a Process" -excerpt: "Regsvcs/Regasm" +excerpt: "Signed Binary Proxy Execution, Regsvcs/Regasm" categories: - Endpoint last_modified_at: 2021-02-12 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.009 - Regsvcs/Regasm - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies regasm.exe spawning a process. This particular #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md index 3a80c39e31..04a345a573 100644 --- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md @@ -1,6 +1,6 @@ --- title: "Detect Regsvcs Spawning a Process" -excerpt: "Regsvcs/Regasm" +excerpt: "Signed Binary Proxy Execution, Regsvcs/Regasm" categories: - Endpoint last_modified_at: 2021-02-12 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.009 - Regsvcs/Regasm - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies regsvcs.exe spawning a process. This particula #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md b/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md index 1504162936..5f11c8d849 100644 --- a/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md +++ b/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md @@ -1,6 +1,6 @@ --- title: "Detect Regasm with Network Connection" -excerpt: "Regsvcs/Regasm" +excerpt: "Signed Binary Proxy Execution, Regsvcs/Regasm" categories: - Endpoint last_modified_at: 2021-02-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.009 - Regsvcs/Regasm - Defense Evasion @@ -36,10 +39,17 @@ The following analytic identifies regasm.exe with a network connection to a publ #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ Although unlikely, limited instances of regasm.exe with a network connection may + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md b/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md index 9e39e563ec..e655341ae9 100644 --- a/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md @@ -1,6 +1,6 @@ --- title: "Detect Regsvcs with Network Connection" -excerpt: "Regsvcs/Regasm" +excerpt: "Signed Binary Proxy Execution, Regsvcs/Regasm" categories: - Endpoint last_modified_at: 2021-02-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.009 - Regsvcs/Regasm - Defense Evasion @@ -36,10 +39,17 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | + + + #### Search ``` @@ -77,7 +87,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive. + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md index 0260349ff1..44b94c113d 100644 --- a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md +++ b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md @@ -1,6 +1,6 @@ --- title: "AWS Create Policy Version to allow all resources" -excerpt: "Cloud Accounts" +excerpt: "Cloud Accounts, Valid Accounts" categories: - Cloud last_modified_at: 2021-02-22 @@ -14,6 +14,12 @@ tags: - Persistence - Privilege Escalation - Initial Access + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -40,10 +46,17 @@ This search looks for AWS CloudTrail events where a user created a policy versio #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + + + #### Search ``` @@ -81,7 +94,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +102,7 @@ While this search has no known false positives, it is possible that an AWS admin + #### Reference * [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws) diff --git a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md index 6d56db3285..25826b16d7 100644 --- a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md +++ b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md @@ -38,11 +38,14 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -81,7 +84,6 @@ To successfully implement this search, you need to be ingesting logs with the pr The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some of the named pipes identified and added may cause false positives. Filter by process name or pipe name to reduce false positives. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +92,7 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index 9e28b9140d..b376655e36 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -39,11 +39,14 @@ The following analytic identifies the use of a curl contacting suspicious remote #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | + + #### Search ``` @@ -84,6 +87,7 @@ Unknown. Filter as needed. + #### Reference * [https://redcanary.com/blog/clipping-silver-sparrows-wings/](https://redcanary.com/blog/clipping-silver-sparrows-wings/) diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 95da496f07..215fd0fb3f 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -1,6 +1,6 @@ --- title: "Suspicious PlistBuddy Usage" -excerpt: "Launch Agent" +excerpt: "Launch Agent, Create or Modify System Process" categories: - Endpoint last_modified_at: 2021-02-22 @@ -12,6 +12,10 @@ tags: - Launch Agent - Persistence - Privilege Escalation + - T1543 + - Create or Modify System Process + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -47,10 +51,17 @@ Upon triage, capture the property list file being written to disk and review for #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1543.001](https://attack.mitre.org/techniques/T1543/001/) | Launch Agent | Persistence, Privilege Escalation | + +| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -90,6 +101,7 @@ Some legitimate applications may use PlistBuddy to create or modify property lis + #### Reference * [https://redcanary.com/blog/clipping-silver-sparrows-wings/](https://redcanary.com/blog/clipping-silver-sparrows-wings/) diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index 063270c2bf..06f81681f0 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -1,6 +1,6 @@ --- title: "Suspicious PlistBuddy Usage via OSquery" -excerpt: "Launch Agent" +excerpt: "Launch Agent, Create or Modify System Process" categories: - Endpoint last_modified_at: 2021-02-22 @@ -12,6 +12,10 @@ tags: - Launch Agent - Persistence - Privilege Escalation + - T1543 + - Create or Modify System Process + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -46,10 +50,17 @@ Upon triage, capture the property list file being written to disk and review for #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1543.001](https://attack.mitre.org/techniques/T1543/001/) | Launch Agent | Persistence, Privilege Escalation | + +| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -79,6 +90,7 @@ Some legitimate applications may use PlistBuddy to create or modify property lis + #### Reference * [https://redcanary.com/blog/clipping-silver-sparrows-wings/](https://redcanary.com/blog/clipping-silver-sparrows-wings/) diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index 75a207c8ea..485690331a 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -39,11 +39,14 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1074](https://attack.mitre.org/techniques/T1074/) | Data Staged | Collection | + + #### Search ``` @@ -83,6 +86,7 @@ Unknown. + #### Reference * [https://redcanary.com/blog/clipping-silver-sparrows-wings/](https://redcanary.com/blog/clipping-silver-sparrows-wings/) diff --git a/docs/_posts/2021-03-01-any_powershell_downloadfile.md b/docs/_posts/2021-03-01-any_powershell_downloadfile.md index 6843874547..ec5e041166 100644 --- a/docs/_posts/2021-03-01-any_powershell_downloadfile.md +++ b/docs/_posts/2021-03-01-any_powershell_downloadfile.md @@ -1,6 +1,6 @@ --- title: "Any Powershell DownloadFile" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2021-03-01 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -37,10 +40,17 @@ The following analytic identifies the use of PowerShell downloading a file using #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ False positives may be present and filtering will need to occur by parent proces + #### Reference * [https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0) diff --git a/docs/_posts/2021-03-01-any_powershell_downloadstring.md b/docs/_posts/2021-03-01-any_powershell_downloadstring.md index f1f60c68ae..862dcfe4ce 100644 --- a/docs/_posts/2021-03-01-any_powershell_downloadstring.md +++ b/docs/_posts/2021-03-01-any_powershell_downloadstring.md @@ -1,6 +1,6 @@ --- title: "Any Powershell DownloadString" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2021-03-01 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -37,10 +40,17 @@ The following analytic identifies the use of PowerShell downloading a file using #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -84,7 +94,6 @@ To successfully implement this search you need to be ingesting information on pr False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ False positives may be present and filtering will need to occur by parent proces + #### Reference * [https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0) diff --git a/docs/_posts/2021-03-01-eventvwr_uac_bypass.md b/docs/_posts/2021-03-01-eventvwr_uac_bypass.md index 72e94a3d17..0f821b9c08 100644 --- a/docs/_posts/2021-03-01-eventvwr_uac_bypass.md +++ b/docs/_posts/2021-03-01-eventvwr_uac_bypass.md @@ -1,6 +1,6 @@ --- title: "Eventvwr UAC Bypass" -excerpt: "Bypass User Account Control" +excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism" categories: - Endpoint last_modified_at: 2021-03-01 @@ -12,6 +12,10 @@ tags: - Bypass User Account Control - Privilege Escalation - Defense Evasion + - T1548 + - Abuse Elevation Control Mechanism + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +43,17 @@ The following search identifies Eventvwr bypass by identifying the registry modi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | + +| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -80,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Some false positives may be present and will need to be filtered. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +99,7 @@ Some false positives may be present and will need to be filtered. + #### Reference * [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/) diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md index e6d4e626c3..f4004b1595 100644 --- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md +++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md @@ -1,6 +1,6 @@ --- title: "FodHelper UAC Bypass" -excerpt: "Modify Registry, Bypass User Account Control" +excerpt: "Modify Registry, Bypass User Account Control, Abuse Elevation Control Mechanism" categories: - Endpoint last_modified_at: 2021-03-01 @@ -15,6 +15,10 @@ tags: - Bypass User Account Control - Privilege Escalation - Defense Evasion + - T1548 + - Abuse Elevation Control Mechanism + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -46,11 +50,21 @@ Upon triage, fodhelper.exe will have a child process and read access will occur #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + + | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | + +| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -91,7 +105,6 @@ To successfully implement this search you need to be ingesting information on pr Limited to no false positives are expected. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -100,6 +113,7 @@ Limited to no false positives are expected. + #### Reference * [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/) diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md index bc650975f9..a472e6e09f 100644 --- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md +++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md @@ -1,6 +1,6 @@ --- title: "Ryuk Wake on LAN Command" -excerpt: "Windows Command Shell" +excerpt: "Command and Scripting Interpreter, Windows Command Shell" categories: - Endpoint last_modified_at: 2021-03-01 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.003 - Windows Command Shell - Execution @@ -38,10 +41,17 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Limited to no known false positives. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ Limited to no known false positives. + #### Reference * [https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/](https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/) diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md index 44c449167f..2cf6fa5de8 100644 --- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md +++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md @@ -1,6 +1,6 @@ --- title: "Suspicious Scheduled Task from Public Directory" -excerpt: "Scheduled Task" +excerpt: "Scheduled Task, Scheduled Task/Job" categories: - Endpoint last_modified_at: 2021-03-01 @@ -13,6 +13,11 @@ tags: - Execution - Persistence - Privilege Escalation + - T1053 + - Scheduled Task/Job + - Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +45,17 @@ The following detection identifies Scheduled Tasks registering (creating a new t #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | + +| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -85,7 +97,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives may be present. Filter as needed by parent process or command line argument. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +105,7 @@ Limited false positives may be present. Filter as needed by parent process or co + #### Reference * [https://attack.mitre.org/techniques/T1053/005/](https://attack.mitre.org/techniques/T1053/005/) diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md index 2430d5750c..adfc31b7b1 100644 --- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md +++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md @@ -1,6 +1,6 @@ --- title: "AWS SetDefaultPolicyVersion" -excerpt: "Cloud Accounts" +excerpt: "Cloud Accounts, Valid Accounts" categories: - Cloud last_modified_at: 2021-03-02 @@ -14,6 +14,12 @@ tags: - Persistence - Privilege Escalation - Initial Access + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -40,10 +46,17 @@ This search looks for AWS CloudTrail events where a user has set a default polic #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + + + #### Search ``` @@ -78,7 +91,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +99,7 @@ While this search has no known false positives, it is possible that an AWS admin + #### Reference * [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws) diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md index 3bca3a550f..e0250bfbe0 100644 --- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md +++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-26857 - Endpoint - Exploitation --- @@ -37,11 +38,14 @@ This detection identifies Microsoft Exchange Server's Unified Messaging serv #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | + + #### Search ``` @@ -79,7 +83,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Unknown. Tune out child processes as needed to limit volume of false positives. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +91,14 @@ Unknown. Tune out child processes as needed to limit volume of false positives. +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-26857](https://nvd.nist.gov/vuln/detail/CVE-2021-26857) | Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078. | 6.8 | + + + #### Reference * [https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/](https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/) diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md index ce1dafdd3e..857c7572ab 100644 --- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md +++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md @@ -1,6 +1,6 @@ --- title: "Windows DisableAntiSpyware Registry" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-02 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -77,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ It is unusual to turn this feature off a Windows system since it is a default se + #### Reference * [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/) diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index 85b83daff3..a9e5a6c986 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -1,6 +1,6 @@ --- title: "Nishang PowershellTCPOneLine" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2021-03-03 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -37,10 +40,17 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives may be present. Filter as needed based on initial analysis. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Limited false positives may be present. Filter as needed based on initial analys + #### Reference * [https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1](https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1) diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index 1a387ac7f9..f0dd43d531 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -1,6 +1,6 @@ --- title: "W3WP Spawning Shell" -excerpt: "Web Shell" +excerpt: "Server Software Component, Web Shell" categories: - Endpoint last_modified_at: 2021-03-03 @@ -8,12 +8,18 @@ toc: true toc_label: "" tags: - TTP + - T1505 + - Server Software Component + - Persistence - T1505.003 - Web Shell - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-34473 + - CVE-2021-34523 + - CVE-2021-31207 - Endpoint - Exploitation --- @@ -37,10 +43,17 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1505](https://attack.mitre.org/techniques/T1505/) | Server Software Component | Persistence | + + | [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence | + + + #### Search ``` @@ -83,7 +96,6 @@ To successfully implement this search you need to be ingesting information on pr Baseline your environment before production. It is possible build systems using IIS will spawn cmd.exe to perform a software build. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +104,16 @@ Baseline your environment before production. It is possible build systems using +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34473](https://nvd.nist.gov/vuln/detail/CVE-2021-34473) | Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-31206. | 10.0 | +| [CVE-2021-34523](https://nvd.nist.gov/vuln/detail/CVE-2021-34523) | Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33768, CVE-2021-34470. | 7.5 | +| [CVE-2021-31207](https://nvd.nist.gov/vuln/detail/CVE-2021-31207) | Microsoft Exchange Server Security Feature Bypass Vulnerability | 6.5 | + + + #### Reference * [https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/](https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/) diff --git a/docs/_posts/2021-03-12-create_service_in_suspicious_file_path.md b/docs/_posts/2021-03-12-create_service_in_suspicious_file_path.md index 7623e82aa8..c7e5960522 100644 --- a/docs/_posts/2021-03-12-create_service_in_suspicious_file_path.md +++ b/docs/_posts/2021-03-12-create_service_in_suspicious_file_path.md @@ -1,6 +1,6 @@ --- title: "Create Service In Suspicious File Path" -excerpt: "Service Execution" +excerpt: "System Services, Service Execution" categories: - Endpoint last_modified_at: 2021-03-12 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1569 + - System Services + - Execution - T1569.002 - Service Execution - Execution @@ -37,10 +40,17 @@ This detection is to identify a creation of "user mode service" where th #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution | + + | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | + + + #### Search ``` @@ -75,7 +85,6 @@ To successfully implement this search, you need to be ingesting logs with the Se unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ unknown + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index d9ec2b6ec1..f2e861ced1 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -37,11 +37,14 @@ The following analytics identifies a big number of instance of ransomware notes #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | + + #### Search ``` @@ -81,7 +84,6 @@ You must be ingesting data that records the filesystem activity from your hosts unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +92,7 @@ unknown + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md index c789ad45c6..41f2cd461c 100644 --- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md +++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md @@ -37,11 +37,14 @@ The following analytics identifies the resizing of shadowstorage by ransomware m #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | + + #### Search ``` @@ -78,7 +81,6 @@ To successfully implement this search, you need to be ingesting logs with the pr network admin can resize the shadowstorage for valid purposes. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ network admin can resize the shadowstorage for valid purposes. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-16-high_file_deletion_frequency.md b/docs/_posts/2021-03-16-high_file_deletion_frequency.md index 3de66a2595..8c6193bd77 100644 --- a/docs/_posts/2021-03-16-high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-high_file_deletion_frequency.md @@ -37,11 +37,14 @@ This search looks for high frequency of file deletion relative to process name a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | + + #### Search ``` @@ -78,7 +81,6 @@ To successfully implement this search, you need to be ingesting logs with the de user may delete bunch of pictures or files in a folder. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ user may delete bunch of pictures or files in a folder. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index 39cba53f39..a370ee99aa 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -37,11 +37,14 @@ This analytics are designed to indentify a high frequency of process termination #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | + + #### Search ``` @@ -77,7 +80,6 @@ To successfully implement this search, you need to be ingesting logs with the Im admin or user tool that can terminate multiple process. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ admin or user tool that can terminate multiple process. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md index affda4e13f..531d88d5fe 100644 --- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md +++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md @@ -37,11 +37,14 @@ The following analytics are designed to identifies some CLOP ransomware variant #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr Operators can execute third party tools using these parameters. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ Operators can execute third party tools using these parameters. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index 48a99902c0..617ded8261 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -38,11 +38,14 @@ This detection is to identify the common service name created by the CLOP ransom #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + #### Search ``` @@ -78,7 +81,6 @@ To successfully implement this search, you need to be ingesting logs with the Se unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ unknown + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md b/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md index e0cce34cb2..ea515239fb 100644 --- a/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md +++ b/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md @@ -37,11 +37,14 @@ This detection is to identify a suspicious process that tries to delete the proc #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + #### Search ``` @@ -83,7 +86,6 @@ You must be ingesting data that records process activity from your hosts to popu unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ unknown + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md index 577c061223..12ec1d545a 100644 --- a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md @@ -37,11 +37,14 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | + + #### Search ``` @@ -84,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +95,7 @@ Limited false positives in most environments, however tune as needed based on pa + #### Reference * [https://attack.mitre.org/techniques/T1105/](https://attack.mitre.org/techniques/T1105/) diff --git a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md index cf25dfc578..b39751b2ca 100644 --- a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md @@ -37,11 +37,14 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | + + #### Search ``` @@ -84,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +95,7 @@ Limited false positives in most environments, however tune as needed based on pa + #### Reference * [https://attack.mitre.org/techniques/T1105/](https://attack.mitre.org/techniques/T1105/) diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index 5420434475..8d48fad1e8 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -37,11 +37,14 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1140](https://attack.mitre.org/techniques/T1140/) | Deobfuscate/Decode Files or Information | Defense Evasion | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr Typically seen used to `encode` files, but it is possible to see legitimate use of `decode`. Filter based on parent-child relationship, file paths, endpoint or user. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ Typically seen used to `encode` files, but it is possible to see legitimate use + #### Reference * [https://attack.mitre.org/techniques/T1140/](https://attack.mitre.org/techniques/T1140/) diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index e187fe766b..a409611792 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -38,11 +38,14 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1197](https://attack.mitre.org/techniques/T1197/) | BITS Jobs | Defense Evasion, Persistence | + + #### Search ``` @@ -84,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +95,7 @@ Limited false positives. It is possible administrators will utilize Start-BitsTr + #### Reference * [https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281](https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281) diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md index c892d50767..92e9a2e464 100644 --- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md +++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md @@ -1,6 +1,6 @@ --- title: "AWS IAM Successful Group Deletion" -excerpt: "Cloud Groups, Account Manipulation" +excerpt: "Cloud Groups, Account Manipulation, Permission Groups Discovery" categories: - Cloud last_modified_at: 2021-03-31 @@ -14,6 +14,9 @@ tags: - T1098 - Account Manipulation - Persistence + - T1069 + - Permission Groups Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,8 +43,18 @@ The following query uses IAM events to track the success of a group being delete #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1069.003](https://attack.mitre.org/techniques/T1069/003/) | Cloud Groups | Discovery || [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | +| ----------- | ----------- |--------------- | +| [T1069.003](https://attack.mitre.org/techniques/T1069/003/) | Cloud Groups | Discovery | + + + +| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + @@ -78,7 +91,6 @@ The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. T This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege). - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +99,7 @@ This detection will require tuning to provide high fidelity detection capabiltie + #### Reference * [https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html) diff --git a/docs/_posts/2021-03-31-disable_registry_tool.md b/docs/_posts/2021-03-31-disable_registry_tool.md index 19dd5b8b86..e5c64fd1da 100644 --- a/docs/_posts/2021-03-31-disable_registry_tool.md +++ b/docs/_posts/2021-03-31-disable_registry_tool.md @@ -1,6 +1,6 @@ --- title: "Disable Registry Tool" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-31 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search identifies modification of registry to disable the regedit or regist #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr admin may disable this application for non technical user. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ admin may disable this application for non technical user. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2021-03-31-disable_show_hidden_files.md b/docs/_posts/2021-03-31-disable_show_hidden_files.md index 993e1c78c9..c49eab957a 100644 --- a/docs/_posts/2021-03-31-disable_show_hidden_files.md +++ b/docs/_posts/2021-03-31-disable_show_hidden_files.md @@ -1,6 +1,6 @@ --- title: "Disable Show Hidden Files" -excerpt: "Hidden Files and Directories, Disable or Modify Tools" +excerpt: "Hidden Files and Directories, Disable or Modify Tools, Hide Artifacts, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-31 @@ -14,6 +14,12 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1564 + - Hide Artifacts + - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,8 +46,22 @@ The following analytic is to identify a modification in the Windows registry to #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1564.001](https://attack.mitre.org/techniques/T1564/001/) | Hidden Files and Directories | Defense Evasion || [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | +| ----------- | ----------- |--------------- | +| [T1564.001](https://attack.mitre.org/techniques/T1564/001/) | Hidden Files and Directories | Defense Evasion | + + +| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + + + +| [T1564](https://attack.mitre.org/techniques/T1564/) | Hide Artifacts | Defense Evasion | + + + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + #### Search @@ -79,7 +99,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +107,7 @@ unknown + #### Reference * [https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx](https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx) diff --git a/docs/_posts/2021-03-31-disable_windows_behavior_monitoring.md b/docs/_posts/2021-03-31-disable_windows_behavior_monitoring.md index b9577f98bb..f1ec8d8939 100644 --- a/docs/_posts/2021-03-31-disable_windows_behavior_monitoring.md +++ b/docs/_posts/2021-03-31-disable_windows_behavior_monitoring.md @@ -1,6 +1,6 @@ --- title: "Disable Windows Behavior Monitoring" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-31 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to identifies a modification in registry to disable the windows d #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search you need to be ingesting information on pr admin or user may choose to disable this windows features. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ admin or user may choose to disable this windows features. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html) diff --git a/docs/_posts/2021-03-31-disable_windows_smartscreen_protection.md b/docs/_posts/2021-03-31-disable_windows_smartscreen_protection.md index 535f7bcde3..9a8d972372 100644 --- a/docs/_posts/2021-03-31-disable_windows_smartscreen_protection.md +++ b/docs/_posts/2021-03-31-disable_windows_smartscreen_protection.md @@ -1,6 +1,6 @@ --- title: "Disable Windows SmartScreen Protection" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-31 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following search identifies a modification of registry to disable the smarts #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr admin or user may choose to disable this windows features. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ admin or user may choose to disable this windows features. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html) diff --git a/docs/_posts/2021-03-31-disabling_cmd_application.md b/docs/_posts/2021-03-31-disabling_cmd_application.md index 279b07d087..19acb5711c 100644 --- a/docs/_posts/2021-03-31-disabling_cmd_application.md +++ b/docs/_posts/2021-03-31-disabling_cmd_application.md @@ -1,6 +1,6 @@ --- title: "Disabling CMD Application" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-31 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ this search is to identify modification in registry to disable cmd prompt applic #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr admin may disable this application for non technical user. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ admin may disable this application for non technical user. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2021-03-31-disabling_controlpanel.md b/docs/_posts/2021-03-31-disabling_controlpanel.md index 583c5c7722..f25fafb1f4 100644 --- a/docs/_posts/2021-03-31-disabling_controlpanel.md +++ b/docs/_posts/2021-03-31-disabling_controlpanel.md @@ -1,6 +1,6 @@ --- title: "Disabling ControlPanel" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-31 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ this search is to identify registry modification to disable control panel window #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr admin may disable this application for non technical user. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ admin may disable this application for non technical user. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index e5dc00ebf7..99d356e72b 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -1,6 +1,6 @@ --- title: "Disabling Firewall with Netsh" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-31 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to identifies suspicious firewall disabling using netsh applicati #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr admin may disable firewall during testing or fixing network problem. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ admin may disable firewall during testing or fixing network problem. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm) diff --git a/docs/_posts/2021-03-31-disabling_folderoptions_windows_feature.md b/docs/_posts/2021-03-31-disabling_folderoptions_windows_feature.md index cdf3ed43e2..8b2eeff282 100644 --- a/docs/_posts/2021-03-31-disabling_folderoptions_windows_feature.md +++ b/docs/_posts/2021-03-31-disabling_folderoptions_windows_feature.md @@ -1,6 +1,6 @@ --- title: "Disabling FolderOptions Windows Feature" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-31 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to identify registry modification to disable folder options featu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr admin may disable this application for non technical user. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ admin may disable this application for non technical user. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2021-03-31-disabling_norun_windows_app.md b/docs/_posts/2021-03-31-disabling_norun_windows_app.md index 161103c4d1..d9dc7f88b5 100644 --- a/docs/_posts/2021-03-31-disabling_norun_windows_app.md +++ b/docs/_posts/2021-03-31-disabling_norun_windows_app.md @@ -1,6 +1,6 @@ --- title: "Disabling NoRun Windows App" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-31 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to identify modification of registry to disable run application i #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr admin may disable this application for non technical user. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ admin may disable this application for non technical user. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2021-03-31-disabling_systemrestore_in_registry.md b/docs/_posts/2021-03-31-disabling_systemrestore_in_registry.md index 19424c0020..f014bc9df2 100644 --- a/docs/_posts/2021-03-31-disabling_systemrestore_in_registry.md +++ b/docs/_posts/2021-03-31-disabling_systemrestore_in_registry.md @@ -1,6 +1,6 @@ --- title: "Disabling SystemRestore In Registry" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-31 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following search identifies the modification of registry related in disablin #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr in some cases admin can disable systemrestore on a machine. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ in some cases admin can disable systemrestore on a machine. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html) diff --git a/docs/_posts/2021-03-31-disabling_task_manager.md b/docs/_posts/2021-03-31-disabling_task_manager.md index 71e9c0f0b8..e02871bdc7 100644 --- a/docs/_posts/2021-03-31-disabling_task_manager.md +++ b/docs/_posts/2021-03-31-disabling_task_manager.md @@ -1,6 +1,6 @@ --- title: "Disabling Task Manager" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-03-31 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to identifies modification of registry to disable the task manage #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr admin may disable this application for non technical user. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ admin may disable this application for non technical user. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md index 96fd9001ba..b10ec2bdbc 100644 --- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md +++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md @@ -42,11 +42,14 @@ In addition to trust discovery, review parallel processes for additional behavio #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + #### Search ``` @@ -85,7 +88,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives. If there is a true false positive, filter based on command-line or parent process. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +96,7 @@ Limited false positives. If there is a true false positive, filter based on comm + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md) diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md index 93126b3560..9596e4051d 100644 --- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md +++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md @@ -40,12 +40,18 @@ The following detection identifies any malformed policy document exceptions with #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1580](https://attack.mitre.org/techniques/T1580/) | Cloud Infrastructure Discovery | Discovery | + + + | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + + #### Search ``` @@ -80,7 +86,6 @@ The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. T This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +94,7 @@ This detection will require tuning to provide high fidelity detection capabiltie + #### Reference * [https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities](https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities) diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md index 00b415c7c7..c7cbdc3dc8 100644 --- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md +++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md @@ -37,11 +37,14 @@ The following detection identifes when a policy is deleted on AWS. This does not #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + #### Search ``` @@ -75,7 +78,6 @@ The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. T This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +86,7 @@ This detection will require tuning to provide high fidelity detection capabiltie + #### Reference * [https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html) diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md index 6f9ea2cc15..8382f67e64 100644 --- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md +++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md @@ -37,11 +37,14 @@ This detection identifies failure attempts to delete groups. We want to identify #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | + + #### Search ``` @@ -75,7 +78,6 @@ The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. T This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege). - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +86,7 @@ This detection will require tuning to provide high fidelity detection capabiltie + #### Reference * [https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html) diff --git a/docs/_posts/2021-04-05-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-04-05-aws_iam_accessdenied_discovery_events.md index 0091e36a55..15dd4fa02b 100644 --- a/docs/_posts/2021-04-05-aws_iam_accessdenied_discovery_events.md +++ b/docs/_posts/2021-04-05-aws_iam_accessdenied_discovery_events.md @@ -37,11 +37,14 @@ The following detection identifies excessive AccessDenied events within an hour #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1580](https://attack.mitre.org/techniques/T1580/) | Cloud Infrastructure Discovery | Discovery | + + #### Search ``` @@ -78,7 +81,6 @@ The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. T It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ It is possible to start this detection will need to be tuned by source IP or use + #### Reference * [https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/](https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/) diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index cc9b0afbbc..fbc952f961 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -1,6 +1,6 @@ --- title: "Malicious Powershell Executed As A Service" -excerpt: "Service Execution" +excerpt: "System Services, Service Execution" categories: - Endpoint last_modified_at: 2021-04-07 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1569 + - System Services + - Execution - T1569.002 - Service Execution - Execution @@ -37,10 +40,17 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution | + + | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | + + + #### Search ``` @@ -86,7 +96,6 @@ To successfully implement this search, you need to be ingesting Windows System l Creating a hidden powershell service is rare and could key off of those instances. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +104,7 @@ Creating a hidden powershell service is rare and could key off of those instance + #### Reference * [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf) diff --git a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md index ffc4333087..dc3c170482 100644 --- a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md +++ b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md @@ -1,6 +1,6 @@ --- title: "Multiple Users Failing To Authenticate From Host Using Kerberos" -excerpt: "Password Spraying" +excerpt: "Password Spraying, Brute Force" categories: - Endpoint last_modified_at: 2021-04-08 @@ -11,6 +11,9 @@ tags: - T1110.003 - Password Spraying - Credential Access + - T1110 + - Brute Force + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +43,17 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + + + + + #### Search ``` @@ -80,7 +90,6 @@ To successfully implement this search, you need to be ingesting Domain Controlle A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, missconfigured systems and multi-user systems like Citrix farms. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +98,7 @@ A host failing to authenticate with multiple valid domain users is not a common + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md index 9798a5c278..fec33917a0 100644 --- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md +++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md @@ -1,6 +1,6 @@ --- title: "WinEvent Scheduled Task Created Within Public Path" -excerpt: "Scheduled Task" +excerpt: "Scheduled Task, Scheduled Task/Job" categories: - Endpoint last_modified_at: 2021-04-08 @@ -13,6 +13,11 @@ tags: - Execution - Persistence - Privilege Escalation + - T1053 + - Scheduled Task/Job + - Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -42,10 +47,17 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | + +| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -84,7 +96,6 @@ To successfully implement this search, you need to be ingesting Windows Security False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +104,7 @@ False positives are possible if legitimate applications are allowed to register + #### Reference * [https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/](https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/) diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index 401bc26f49..606b8fded6 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -1,6 +1,6 @@ --- title: "Excel Spawning PowerShell" -excerpt: "Security Account Manager" +excerpt: "Security Account Manager, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-04-12 @@ -11,6 +11,9 @@ tags: - T1003.002 - Security Account Manager - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr False positives should be limited, but if any are present, filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ False positives should be limited, but if any are present, filter as needed. + #### Reference * [https://redcanary.com/threat-detection-report/techniques/powershell/](https://redcanary.com/threat-detection-report/techniques/powershell/) diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md index 923da4c316..c8cd6162c0 100644 --- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md @@ -1,6 +1,6 @@ --- title: "Excel Spawning Windows Script Host" -excerpt: "Security Account Manager" +excerpt: "Security Account Manager, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-04-12 @@ -11,6 +11,9 @@ tags: - T1003.002 - Security Account Manager - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following detection identifies Microsoft Excel spawning Windows Script Host #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -77,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr False positives should be limited, but if any are present, filter as needed. In some instances, `cscript.exe` is used for legitimate business practices. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ False positives should be limited, but if any are present, filter as needed. In + #### Reference * [https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/](https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/) diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md index cd0319302d..3efe529cd7 100644 --- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md +++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md @@ -1,6 +1,6 @@ --- title: "WinEvent Scheduled Task Created to Spawn Shell" -excerpt: "Scheduled Task" +excerpt: "Scheduled Task, Scheduled Task/Job" categories: - Endpoint last_modified_at: 2021-04-12 @@ -13,6 +13,11 @@ tags: - Execution - Persistence - Privilege Escalation + - T1053 + - Scheduled Task/Job + - Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -42,10 +47,17 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | + +| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -83,7 +95,6 @@ To successfully implement this search, you need to be ingesting Windows Security False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +103,7 @@ False positives are possible if legitimate applications are allowed to register + #### Reference * [https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/](https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/) diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index b45d735e08..9226c2ef1b 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -1,6 +1,6 @@ --- title: "Winword Spawning PowerShell" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-04-12 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr False positives should be limited, but if any are present, filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ False positives should be limited, but if any are present, filter as needed. + #### Reference * [https://redcanary.com/threat-detection-report/techniques/powershell/](https://redcanary.com/threat-detection-report/techniques/powershell/) diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md index f5d3885b63..ce7961ca1f 100644 --- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md @@ -1,6 +1,6 @@ --- title: "Winword Spawning Windows Script Host" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-04-12 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -77,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr There will be limited false positives and it will be different for every environment. Tune by child process or command-line as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ There will be limited false positives and it will be different for every environ + #### Reference * [https://attack.mitre.org/techniques/T1566/001/](https://attack.mitre.org/techniques/T1566/001/) diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md index 02b2df3bdd..69c7e9929d 100644 --- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md +++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md @@ -37,11 +37,14 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | + + #### Search ``` @@ -77,7 +80,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit While this search has no known false positives. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ While this search has no known false positives. + #### Reference * [https://github.com/aquasecurity/cloudsploit](https://github.com/aquasecurity/cloudsploit) diff --git a/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md b/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md index 684868a64b..c606f73a09 100644 --- a/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md +++ b/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md @@ -1,6 +1,6 @@ --- title: "Multiple Users Attempting To Authenticate Using Explicit Credentials" -excerpt: "Password Spraying" +excerpt: "Password Spraying, Brute Force" categories: - Endpoint last_modified_at: 2021-04-13 @@ -11,6 +11,9 @@ tags: - T1110.003 - Password Spraying - Credential Access + - T1110 + - Brute Force + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +43,17 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + + + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search, you need to be ingesting Windows Event Lo A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ A source user failing attempting to authenticate multiple users on a host is not + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md index 200bda345c..7b82cbea4d 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md @@ -1,6 +1,6 @@ --- title: "Multiple Users Failing To Authenticate From Host Using NTLM" -excerpt: "Password Spraying" +excerpt: "Password Spraying, Brute Force" categories: - Endpoint last_modified_at: 2021-04-13 @@ -11,6 +11,9 @@ tags: - T1110.003 - Password Spraying - Credential Access + - T1110 + - Brute Force + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +43,17 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + + + + + #### Search ``` @@ -80,7 +90,6 @@ To successfully implement this search, you need to be ingesting Domain Controlle A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +98,7 @@ A host failing to authenticate with multiple valid domain users is not a common + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md index 46854a8454..9d79af631c 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md @@ -1,6 +1,6 @@ --- title: "Multiple Users Failing To Authenticate From Process" -excerpt: "Password Spraying" +excerpt: "Password Spraying, Brute Force" categories: - Endpoint last_modified_at: 2021-04-13 @@ -11,6 +11,9 @@ tags: - T1110.003 - Password Spraying - Credential Access + - T1110 + - Brute Force + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +43,17 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + + + + + #### Search ``` @@ -84,7 +94,6 @@ To successfully implement this search, you need to be ingesting Windows Event Lo A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ A process failing to authenticate with multiple users is not a common behavior f + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md index 9be61a4d7f..9f4491d052 100644 --- a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md +++ b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md @@ -1,6 +1,6 @@ --- title: "Multiple Users Remotely Failing To Authenticate From Host" -excerpt: "Password Spraying" +excerpt: "Password Spraying, Brute Force" categories: - Endpoint last_modified_at: 2021-04-13 @@ -11,6 +11,9 @@ tags: - T1110.003 - Password Spraying - Credential Access + - T1110 + - Brute Force + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +43,17 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + + + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search, you need to be ingesting Windows Event Lo A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ A host failing to authenticate with multiple valid users against a remote host i + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index 94bbf4b715..c8ddddbaf8 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -1,6 +1,6 @@ --- title: "Office Application Spawn rundll32 process" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-04-13 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ this detection was designed to identifies suspicious spawned process of known MS #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ unknown + #### Reference * [https://any.run/malware-trends/trickbot](https://any.run/malware-trends/trickbot) diff --git a/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md index cd3287c4a5..6a9e227cb7 100644 --- a/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md +++ b/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md @@ -1,6 +1,6 @@ --- title: "Multiple Disabled Users Failing To Authenticate From Host Using Kerberos" -excerpt: "Password Spraying" +excerpt: "Password Spraying, Brute Force" categories: - Endpoint last_modified_at: 2021-04-14 @@ -11,6 +11,9 @@ tags: - T1110.003 - Password Spraying - Credential Access + - T1110 + - Brute Force + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +43,17 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + + + + + #### Search ``` @@ -80,7 +90,6 @@ To successfully implement this search, you need to be ingesting Domain Controlle A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +98,7 @@ A host failing to authenticate with multiple disabled domain users is not a comm + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md index 1d828ef654..3d84fc9c0c 100644 --- a/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md +++ b/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md @@ -1,6 +1,6 @@ --- title: "Multiple Invalid Users Failing To Authenticate From Host Using Kerberos" -excerpt: "Password Spraying" +excerpt: "Password Spraying, Brute Force" categories: - Endpoint last_modified_at: 2021-04-14 @@ -11,6 +11,9 @@ tags: - T1110.003 - Password Spraying - Credential Access + - T1110 + - Brute Force + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +43,17 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + + + + + #### Search ``` @@ -80,7 +90,6 @@ To successfully implement this search, you need to be ingesting Domain Controlle A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +98,7 @@ A host failing to authenticate with multiple invalid domain users is not a commo + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index 74aab63408..0b9fb12312 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -1,6 +1,6 @@ --- title: "Office Document Creating Schedule Task" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-04-14 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ this search detects a potential malicious office document that create schedule t #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ unknown + #### Reference * [https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/](https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/) diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index 26d20db2b5..a2f1e15684 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -1,6 +1,6 @@ --- title: "Office Document Executing Macro Code" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-04-14 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ this detection was designed to identifies suspicious office documents that using #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -80,7 +90,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Normal Office Document macro use for automation - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +98,7 @@ Normal Office Document macro use for automation + #### Reference * [https://www.joesandbox.com/analysis/386500/0/html](https://www.joesandbox.com/analysis/386500/0/html) diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md index a0bb39dddd..3c655ff7a7 100644 --- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md +++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md @@ -37,11 +37,14 @@ this search is to detect potential DNS exfiltration using nslookup application. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | + + #### Search ``` @@ -86,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr admin nslookup usage - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +97,7 @@ admin nslookup usage + #### Reference * [https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html](https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html) diff --git a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md index 71d368ae11..2a29ffe353 100644 --- a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md @@ -1,6 +1,6 @@ --- title: "Multiple Invalid Users Failing To Authenticate From Host Using NTLM" -excerpt: "Password Spraying" +excerpt: "Password Spraying, Brute Force" categories: - Endpoint last_modified_at: 2021-04-15 @@ -11,6 +11,9 @@ tags: - T1110.003 - Password Spraying - Credential Access + - T1110 + - Brute Force + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -40,10 +43,17 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + + + + + #### Search ``` @@ -80,7 +90,6 @@ To successfully implement this search, you need to be ingesting Domain Controlle A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +98,7 @@ A host failing to authenticate with multiple invalid domain users is not a commo + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md index 514819b7dc..ac7f74d5a4 100644 --- a/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md @@ -38,25 +38,28 @@ The following analytic identifies gpupdate.exe with no command line arguments an #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + #### Search ``` -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(gpupdate\.exe.{0,4}$)" -| join process_id [ -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] -| table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port +| table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter` ``` @@ -85,7 +88,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives may be present in small environments. Tuning may be required based on parent process. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +96,7 @@ Limited false positives may be present in small environments. Tuning may be requ + #### Reference * [https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile](https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile) diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index 490045ebeb..56027d05df 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -38,11 +38,14 @@ this search is designed to detect suspicious powershell process that tries to in #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ unknown + #### Reference * [https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/](https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/) diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md index 47ceabe2f4..93563de5c8 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md +++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md @@ -39,11 +39,14 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search, you need to be ingesting logs with the ta unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ unknown + #### Reference * [https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/](https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/) diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md index b126ce045a..3907db81c0 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md +++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md @@ -39,11 +39,14 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + #### Search ``` @@ -84,7 +87,6 @@ To successfully implement this search, you need to be ingesting logs with the ta unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +95,7 @@ unknown + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md index f211d7243f..5b62051292 100644 --- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md +++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md @@ -1,6 +1,6 @@ --- title: "Wermgr Process Connecting To IP Check Web Services" -excerpt: "IP Addresses" +excerpt: "Gather Victim Network Information, IP Addresses" categories: - Endpoint last_modified_at: 2021-04-19 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1590 + - Gather Victim Network Information + - Reconnaissance - T1590.005 - IP Addresses - Reconnaissance @@ -37,10 +40,17 @@ this search is designed to detect suspicious wermgr.exe process that tries to co #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance | + + | [T1590.005](https://attack.mitre.org/techniques/T1590/005/) | IP Addresses | Reconnaissance | + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ unknown + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index 0065fce052..d4f77b1293 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -37,11 +37,14 @@ this search is designed to detect potential malicious wermgr.exe process that dr #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion | + + #### Search ``` @@ -77,7 +80,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ unknown + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index 138d3587b9..7d4cd82e38 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -37,11 +37,14 @@ This search is designed to detect suspicious cmd and powershell process spawned #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ unknown + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md index f48d380bcf..222ea94c6c 100644 --- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md @@ -37,11 +37,14 @@ This search is to detect potential DNS exfiltration using nslookup application. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ unknown + #### Reference * [https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html](https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html) diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index e65ff32d92..1a56252da5 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -1,6 +1,6 @@ --- title: "Multiple Archive Files Http Post Traffic" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" +excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Exfiltration Over Alternative Protocol" categories: - Network last_modified_at: 2021-04-21 @@ -11,6 +11,9 @@ tags: - T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol - Exfiltration + - T1048 + - Exfiltration Over Alternative Protocol + - Exfiltration - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is designed to detect high frequency of archive files data exfiltrat #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | + +| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | + + + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search, you need to be ingesting logs with the st Normal archive transfer via HTTP protocol may trip this detection. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ Normal archive transfer via HTTP protocol may trip this detection. + #### Reference * [https://attack.mitre.org/techniques/T1560/001/](https://attack.mitre.org/techniques/T1560/001/) diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md index 41d14ec462..4abc931bdc 100644 --- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md +++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md @@ -1,6 +1,6 @@ --- title: "Anomalous usage of 7zip" -excerpt: "Archive via Utility" +excerpt: "Archive via Utility, Archive Collected Data" categories: - Endpoint last_modified_at: 2021-04-22 @@ -11,6 +11,9 @@ tags: - T1560.001 - Archive via Utility - Collection + - T1560 + - Archive Collected Data + - Collection - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1560.001](https://attack.mitre.org/techniques/T1560/001/) | Archive via Utility | Collection | + +| [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection | + + + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr False positives should be limited as this behavior is not normal for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ False positives should be limited as this behavior is not normal for `rundll32.e + #### Reference * [https://attack.mitre.org/techniques/T1560/001/](https://attack.mitre.org/techniques/T1560/001/) diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index a5f0631389..d16f3f1136 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -1,6 +1,6 @@ --- title: "Office Product Spawning Rundll32 with no DLL" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-04-22 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ The following detection identifies the latest behavior utilized by IcedID malwar #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr False positives should be limited, but if any are present, filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ False positives should be limited, but if any are present, filter as needed. + #### Reference * [https://www.joesandbox.com/analysis/395471/0/html](https://www.joesandbox.com/analysis/395471/0/html) diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index 45ff6fdefe..27cad93557 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -1,6 +1,6 @@ --- title: "Plain HTTP POST Exfiltrated Data" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" +excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Exfiltration Over Alternative Protocol" categories: - Network last_modified_at: 2021-04-22 @@ -11,6 +11,9 @@ tags: - T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol - Exfiltration + - T1048 + - Exfiltration Over Alternative Protocol + - Exfiltration - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | + +| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | + + + + + #### Search ``` @@ -77,7 +87,6 @@ To successfully implement this search, you need to be ingesting logs with the st unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ unknown + #### Reference * [https://blog.talosintelligence.com/2020/03/trickbot-primer.html](https://blog.talosintelligence.com/2020/03/trickbot-primer.html) diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index 968056a86a..652682b233 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -1,6 +1,6 @@ --- title: "Winword Spawning Cmd" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-04-22 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr False positives should be limited, but if any are present, filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ False positives should be limited, but if any are present, filter as needed. + #### Reference * [https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/](https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/) diff --git a/docs/_posts/2021-04-23-write_executable_in_smb_share.md b/docs/_posts/2021-04-23-write_executable_in_smb_share.md index a8d1ab763e..e61f94346f 100644 --- a/docs/_posts/2021-04-23-write_executable_in_smb_share.md +++ b/docs/_posts/2021-04-23-write_executable_in_smb_share.md @@ -1,6 +1,6 @@ --- title: "Write Executable in SMB Share" -excerpt: "SMB/Windows Admin Shares" +excerpt: "Remote Services, SMB/Windows Admin Shares" categories: - Endpoint last_modified_at: 2021-04-23 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1021 + - Remote Services + - Lateral Movement - T1021.002 - SMB/Windows Admin Shares - Lateral Movement @@ -37,10 +40,17 @@ This search is to detect suspicious dropping or creating an executable file in k #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search, you need to be ingesting Windows Security unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ unknown + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index 69074c1d73..116e6485f2 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -1,6 +1,6 @@ --- title: "Office Product Spawning BITSAdmin" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-04-26 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ The following detection identifies the latest behavior utilized by different mal #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr No false positives known. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ No false positives known. Filter as needed. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md) diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index 1a60e2cf43..dc211d137b 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -1,6 +1,6 @@ --- title: "Office Product Spawning CertUtil" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-04-26 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ The following detection identifies the latest behavior utilized by different mal #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr No false positives known. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ No false positives known. Filter as needed. + #### Reference * [https://redcanary.com/threat-detection-report/threats/TA551/](https://redcanary.com/threat-detection-report/threats/TA551/) diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index 67b19c28c6..329ebd1dc1 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -1,6 +1,6 @@ --- title: "Office Product Spawning MSHTA" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-04-26 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ The following detection identifies the latest behavior utilized by different mal #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr No false positives known. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ No false positives known. Filter as needed. + #### Reference * [https://redcanary.com/threat-detection-report/threats/TA551/](https://redcanary.com/threat-detection-report/threats/TA551/) diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index 418d081bd8..5baa8b22fc 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -38,11 +38,14 @@ this search is to detect potential trickbot infection through the create/connect #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ unknown + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md index cafdc5a88a..8c8a6e7b13 100644 --- a/docs/_posts/2021-04-29-icacls_deny_command.md +++ b/docs/_posts/2021-04-29-icacls_deny_command.md @@ -37,11 +37,14 @@ This analytic identifies a potential adversary that changes the security permiss #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | + + #### Search ``` @@ -78,7 +81,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Unknown. It is possible some administrative scripts use ICacls. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ Unknown. It is possible some administrative scripts use ICacls. Filter as needed + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index 370e2e4c65..804033e5c5 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -1,6 +1,6 @@ --- title: "Suspicious Driver Loaded Path" -excerpt: "Windows Service" +excerpt: "Windows Service, Create or Modify System Process" categories: - Endpoint last_modified_at: 2021-04-29 @@ -12,6 +12,10 @@ tags: - Windows Service - Persistence - Privilege Escalation + - T1543 + - Create or Modify System Process + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ This analytic will detect suspicious driver loaded paths. This technique is comm #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | + +| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -77,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the dr Limited false positives will be present. Some applications do load drivers - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +96,7 @@ Limited false positives will be present. Some applications do load drivers + #### Reference * [https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/](https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/) diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index 8f8aba2d7e..f0e2841a4b 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -1,6 +1,6 @@ --- title: "XMRIG Driver Loaded" -excerpt: "Windows Service" +excerpt: "Windows Service, Create or Modify System Process" categories: - Endpoint last_modified_at: 2021-04-29 @@ -12,6 +12,10 @@ tags: - Windows Service - Persistence - Privilege Escalation + - T1543 + - Create or Modify System Process + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ This analytic identifies XMRIG coinminer driver installation on the system. The #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | + +| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -77,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the dr False positives should be limited. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +96,7 @@ False positives should be limited. + #### Reference * [https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/](https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/) diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index 44ba46a293..5514794d1e 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -37,11 +37,14 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr System administrators or scripts may delete user accounts via this technique. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ System administrators or scripts may delete user accounts via this technique. Fi + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index 324ee81d5b..a3908134f7 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -37,11 +37,14 @@ This analytic will identify a suspicious command-line that disables a user accou #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ unknown + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md index 729a1a1408..4590bc671b 100644 --- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md +++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md @@ -37,11 +37,14 @@ This analytic will identify suspicious series of command-line to disable several #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ unknown + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index d592302c47..32aa5c4343 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -37,11 +37,14 @@ This analytic identifies suspicious series of attempt to kill multiple services #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | + + #### Search ``` @@ -85,7 +88,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +96,7 @@ unknown + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md index d16d279de9..47b6262f29 100644 --- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md +++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md @@ -1,6 +1,6 @@ --- title: "Excessive Usage Of Taskkill" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-05-04 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Unknown. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ Unknown. Filter as needed. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md index 84c4362db7..d4b9916548 100644 --- a/docs/_posts/2021-05-04-icacls_grant_command.md +++ b/docs/_posts/2021-05-04-icacls_grant_command.md @@ -37,11 +37,14 @@ This analytic identifies potential adversaries that modify the security permissi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Unknown. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ Unknown. Filter as needed. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md index f609fe82e7..c5e6ddb06c 100644 --- a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md +++ b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md @@ -37,11 +37,14 @@ This analytic identifies suspicious modification of ACL permission to a files or #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | + + #### Search ``` @@ -78,7 +81,6 @@ To successfully implement this search, you need to be ingesting logs with the pr administrators may use this command. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ administrators may use this command. Filter as needed. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index 4a4858cf4c..30073fb236 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -1,6 +1,6 @@ --- title: "Process Kill Base On File Path" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-05-04 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Unknown. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Unknown. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-05-disable_windows_app_hotkeys.md b/docs/_posts/2021-05-05-disable_windows_app_hotkeys.md index 758a867438..3bc9b0bc68 100644 --- a/docs/_posts/2021-05-05-disable_windows_app_hotkeys.md +++ b/docs/_posts/2021-05-05-disable_windows_app_hotkeys.md @@ -1,6 +1,6 @@ --- title: "Disable Windows App Hotkeys" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-05-05 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic detects a suspicious registry modification to disable Windows hotk #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -75,7 +85,6 @@ To successfully implement this search, you must be ingesting data that records r unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ unknown + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-05-hide_user_account_from_sign-in_screen.md b/docs/_posts/2021-05-05-hide_user_account_from_sign-in_screen.md index 53e01b313e..0b9f74bfbb 100644 --- a/docs/_posts/2021-05-05-hide_user_account_from_sign-in_screen.md +++ b/docs/_posts/2021-05-05-hide_user_account_from_sign-in_screen.md @@ -1,6 +1,6 @@ --- title: "Hide User Account From Sign-In Screen" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-05-05 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic identifies a suspicious registry modification to hide a user accou #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -75,7 +85,6 @@ To successfully implement this search, you must be ingesting data that records r Unknown. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ Unknown. Filter as needed. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md index a5e3dd0032..8306a930a7 100644 --- a/docs/_posts/2021-05-05-suspicious_process_file_path.md +++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md @@ -38,11 +38,14 @@ The following analytic will detect a suspicious process running in a file path w #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + #### Search ``` @@ -81,7 +84,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators may allow execution of specific binaries in non-standard paths. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +92,7 @@ Administrators may allow execution of specific binaries in non-standard paths. F + #### Reference * [https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/](https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/) diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index 70bb6f402a..e6fa172d73 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -37,11 +37,14 @@ The following analytic will identify a suspicious download by the Telegram appli #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | + + #### Search ``` @@ -77,7 +80,6 @@ To successfully implement this search, you need to be ingesting logs with the pr normal download of file in telegram app. (if it was a common app in network) - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ normal download of file in telegram app. (if it was a common app in network) + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md index ddea0d84e0..acafcea64f 100644 --- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md +++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md @@ -37,11 +37,14 @@ This analytic will detect a suspicious Telegram process enumerating all network #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + #### Search ``` @@ -80,7 +83,6 @@ To successfully implement this search, you need to be ingesting logs with the Ta unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ unknown + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index 262967e5ae..da46831902 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -37,11 +37,14 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact | + + #### Search ``` @@ -85,7 +88,6 @@ To successfully implement this search you need to be ingesting information on pr unknown. Filter as needed. Modify the time span as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +96,7 @@ unknown. Filter as needed. Modify the time span as needed. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md index edc44fc5f7..36f850fae5 100644 --- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md +++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md @@ -37,11 +37,14 @@ This analytic will identify suspicious executable or scripts (known file extensi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + + #### Search ``` @@ -78,7 +81,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators may allow creation of script or exe in the paths specified. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ Administrators may allow creation of script or exe in the paths specified. Filte + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md index d09fae476a..6ecd7d516c 100644 --- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md +++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md @@ -37,11 +37,14 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or administrative scripts may use this application. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ Administrators or administrative scripts may use this application. Filter as nee + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md index db9843312e..ecb4dc60df 100644 --- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md +++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md @@ -39,11 +39,14 @@ This analytic identifies an on demand run of a Windows Schedule Task through she #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + #### Search ``` @@ -80,7 +83,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators may use to debug Schedule Task entries. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ Administrators may use to debug Schedule Task entries. Filter as needed. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md index eab8792fac..c160656865 100644 --- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md +++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md @@ -37,11 +37,14 @@ This following analytic detects PowerShell command to delete shadow copy using t #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | + + #### Search ``` @@ -77,7 +80,6 @@ To successfully implement this search, you need to be ingesting logs with the po unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ unknown + #### Reference * [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html) diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 83173242bb..75b6bf0a1f 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -1,6 +1,6 @@ --- title: "CMLUA Or CMSTPLUA UAC Bypass" -excerpt: "CMSTP" +excerpt: "Signed Binary Proxy Execution, CMSTP" categories: - Endpoint last_modified_at: 2021-05-13 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.003 - CMSTP - Defense Evasion @@ -37,10 +40,17 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Legitimate windows application that are not on the list loading this dll. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ Legitimate windows application that are not on the list loading this dll. Filter + #### Reference * [https://attack.mitre.org/techniques/T1218/003/](https://attack.mitre.org/techniques/T1218/003/) diff --git a/docs/_posts/2021-05-13-detect_rclone_command-line_usage.md b/docs/_posts/2021-05-13-detect_rclone_command-line_usage.md index d45e6bbc1f..47ddec1cd2 100644 --- a/docs/_posts/2021-05-13-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-05-13-detect_rclone_command-line_usage.md @@ -37,11 +37,14 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration | + + #### Search ``` @@ -80,7 +83,6 @@ To successfully implement this search you need to be ingesting information on pr There is potential for false positives as these arguments may be used by other applications. Filter or tune the analytic as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ There is potential for false positives as these arguments may be used by other a + #### Reference * [https://redcanary.com/blog/rclone-mega-extortion/](https://redcanary.com/blog/rclone-mega-extortion/) diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md index 6e07e3fff0..7670f672ef 100644 --- a/docs/_posts/2021-05-13-slui_runas_elevated.md +++ b/docs/_posts/2021-05-13-slui_runas_elevated.md @@ -1,6 +1,6 @@ --- title: "SLUI RunAs Elevated" -excerpt: "Bypass User Account Control" +excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism" categories: - Endpoint last_modified_at: 2021-05-13 @@ -12,6 +12,10 @@ tags: - Bypass User Account Control - Privilege Escalation - Defense Evasion + - T1548 + - Abuse Elevation Control Mechanism + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | + +| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -80,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives should be present as this is not commonly used by legitimate applications. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +99,7 @@ Limited false positives should be present as this is not commonly used by legiti + #### Reference * [https://www.exploit-db.com/exploits/46998](https://www.exploit-db.com/exploits/46998) diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md index 32f40f520a..175baed703 100644 --- a/docs/_posts/2021-05-13-slui_spawning_a_process.md +++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md @@ -1,6 +1,6 @@ --- title: "SLUI Spawning a Process" -excerpt: "Bypass User Account Control" +excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism" categories: - Endpoint last_modified_at: 2021-05-13 @@ -12,6 +12,10 @@ tags: - Bypass User Account Control - Privilege Escalation - Defense Evasion + - T1548 + - Abuse Elevation Control Mechanism + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | + +| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -80,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +99,7 @@ Certain applications may spawn from `slui.exe` that are legitimate. Filtering wi + #### Reference * [https://www.exploit-db.com/exploits/46998](https://www.exploit-db.com/exploits/46998) diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md index 343ef38b2f..37eed579cc 100644 --- a/docs/_posts/2021-05-18-services_escalate_exe.md +++ b/docs/_posts/2021-05-18-services_escalate_exe.md @@ -39,11 +39,14 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search, you will need to ensure that DNS data is False positives should be limited as `services.exe` should never spawn a process from `ADMIN$`. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ False positives should be limited as `services.exe` should never spawn a process + #### Reference * [https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/](https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/) diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md index 05e82effe3..a5d2d249cc 100644 --- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md +++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md @@ -1,6 +1,6 @@ --- title: "Allow Inbound Traffic In Firewall Rule" -excerpt: "Remote Desktop Protocol" +excerpt: "Remote Desktop Protocol, Remote Services" categories: - Endpoint last_modified_at: 2021-05-19 @@ -11,6 +11,9 @@ tags: - T1021.001 - Remote Desktop Protocol - Lateral Movement + - T1021 + - Remote Services + - Lateral Movement - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following analytic identifies suspicious PowerShell command to allow inbound #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + + + + #### Search ``` @@ -74,7 +84,6 @@ To successfully implement this search, you need to be ingesting logs with the po administrator may allow inbound traffic in certain network or machine. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +92,7 @@ administrator may allow inbound traffic in certain network or machine. + #### Reference * [https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps) diff --git a/docs/_posts/2021-05-19-enable_rdp_in_other_port_number.md b/docs/_posts/2021-05-19-enable_rdp_in_other_port_number.md index e5ec09c66e..b6f1bb2c85 100644 --- a/docs/_posts/2021-05-19-enable_rdp_in_other_port_number.md +++ b/docs/_posts/2021-05-19-enable_rdp_in_other_port_number.md @@ -37,11 +37,14 @@ This search is to detect a modification to registry to enable rdp to a machine w #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + #### Search ``` @@ -76,7 +79,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ unknown + #### Reference * [https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/](https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/) diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md index 0c92bd2ccc..52e9f11371 100644 --- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md +++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md @@ -1,6 +1,6 @@ --- title: "Mailsniper Invoke functions" -excerpt: "Local Email Collection" +excerpt: "Email Collection, Local Email Collection" categories: - Endpoint last_modified_at: 2021-05-19 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1114 + - Email Collection + - Collection - T1114.001 - Local Email Collection - Collection @@ -37,10 +40,17 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | + + | [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection | + + + #### Search ``` @@ -74,7 +84,6 @@ To successfully implement this search, you need to be ingesting logs with the po unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +92,7 @@ unknown + #### Reference * [https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/](https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/) diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index c2cc2049d7..d4773461eb 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -1,6 +1,6 @@ --- title: "CMD Echo Pipe - Escalation" -excerpt: "Windows Command Shell, Windows Service" +excerpt: "Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process" categories: - Endpoint last_modified_at: 2021-05-20 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.003 - Windows Command Shell - Execution @@ -15,6 +18,10 @@ tags: - Windows Service - Persistence - Privilege Escalation + - T1543 + - Create or Modify System Process + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -42,8 +49,22 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution || [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + +| [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | + + +| [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | + + + +| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + + #### Search @@ -88,7 +109,6 @@ To successfully implement this search you need to be ingesting information on pr Unknown. It is possible filtering may be required to ensure fidelity. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -97,6 +117,7 @@ Unknown. It is possible filtering may be required to ensure fidelity. + #### Reference * [https://redcanary.com/threat-detection-report/threats/cobalt-strike/](https://redcanary.com/threat-detection-report/threats/cobalt-strike/) diff --git a/docs/_posts/2021-05-20-rare_parent-child_process_relationship.md b/docs/_posts/2021-05-20-rare_parent-child_process_relationship.md index 7432073b6f..1f34acc093 100644 --- a/docs/_posts/2021-05-20-rare_parent-child_process_relationship.md +++ b/docs/_posts/2021-05-20-rare_parent-child_process_relationship.md @@ -46,14 +46,26 @@ An attacker may use LOLBAS tools spawned from vulnerable applications not typica #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution | + + + | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + + | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + + | [T1072](https://attack.mitre.org/techniques/T1072/) | Software Deployment Tools | Execution, Lateral Movement | + + #### Search ``` @@ -99,6 +111,7 @@ Some custom tools used by admins could be used rarely to launch remotely applica + #### Reference diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index 1a7636e3dc..2ad028fde7 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-31166 - Endpoint - Exploitation - Privilege Escalation @@ -41,11 +42,14 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | + + #### Search ``` @@ -87,6 +91,14 @@ Unknown. Add new processes or filter as needed. It is possible system management +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-31166](https://nvd.nist.gov/vuln/detail/CVE-2021-31166) | HTTP Protocol Stack Remote Code Execution Vulnerability | 7.5 | + + + #### Reference * [https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/win_susp_shell_spawn_from_winrm.yml](https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/win_susp_shell_spawn_from_winrm.yml) diff --git a/docs/_posts/2021-05-26-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2021-05-26-allow_inbound_traffic_by_firewall_rule_registry.md index 9882460fb6..b4b19e68fb 100644 --- a/docs/_posts/2021-05-26-allow_inbound_traffic_by_firewall_rule_registry.md +++ b/docs/_posts/2021-05-26-allow_inbound_traffic_by_firewall_rule_registry.md @@ -1,6 +1,6 @@ --- title: "Allow Inbound Traffic By Firewall Rule Registry" -excerpt: "Remote Desktop Protocol" +excerpt: "Remote Desktop Protocol, Remote Services" categories: - Endpoint last_modified_at: 2021-05-26 @@ -11,6 +11,9 @@ tags: - T1021.001 - Remote Desktop Protocol - Lateral Movement + - T1021 + - Remote Services + - Lateral Movement - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic detects a potential suspicious modification of firewall rule regis #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ network admin may add/remove/modify public inbound firewall rule that may cause + #### Reference * [https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps) diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md index f6b9a63393..67b1c906ef 100644 --- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md +++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md @@ -1,6 +1,6 @@ --- title: "SecretDumps Offline NTDS Dumping Tool" -excerpt: "NTDS" +excerpt: "NTDS, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-05-26 @@ -11,6 +11,9 @@ tags: - T1003.003 - NTDS - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ unknown + #### Reference * [https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py) diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md index 2a507d4662..38a9919529 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md +++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md @@ -1,6 +1,6 @@ --- title: "Detect SharpHound File Modifications" -excerpt: "Domain Account, Local Account, Domain Trust Discovery, Domain Groups, Local Groups" +excerpt: "Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery" categories: - Endpoint last_modified_at: 2021-05-27 @@ -11,17 +11,23 @@ tags: - T1087.002 - Domain Account - Discovery - - T1087.001 - - Local Account + - T1069.001 + - Local Groups - Discovery - T1482 - Domain Trust Discovery - Discovery + - T1087.001 + - Local Account + - Discovery + - T1087 + - Account Discovery + - Discovery - T1069.002 - Domain Groups - Discovery - - T1069.001 - - Local Groups + - T1069 + - Permission Groups Discovery - Discovery - Splunk Enterprise - Splunk Enterprise Security @@ -49,9 +55,32 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery || [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery || [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | -| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery || [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | +| ----------- | ----------- |--------------- | +| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + + +| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | + + + +| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + +| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | + + + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + +| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + + #### Search @@ -90,7 +119,6 @@ To successfully implement this search you need to be ingesting information on fi False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -99,6 +127,7 @@ False positives should be limited as the analytic is specific to a filename with + #### Reference * [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/) diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md index cb96bc6bc5..1be2235867 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_usage.md +++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md @@ -1,6 +1,6 @@ --- title: "Detect SharpHound Usage" -excerpt: "Domain Account, Local Account, Domain Trust Discovery, Domain Groups, Local Groups" +excerpt: "Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery" categories: - Endpoint last_modified_at: 2021-05-27 @@ -11,17 +11,23 @@ tags: - T1087.002 - Domain Account - Discovery - - T1087.001 - - Local Account + - T1069.001 + - Local Groups - Discovery - T1482 - Domain Trust Discovery - Discovery + - T1087.001 + - Local Account + - Discovery + - T1087 + - Account Discovery + - Discovery - T1069.002 - Domain Groups - Discovery - - T1069.001 - - Local Groups + - T1069 + - Permission Groups Discovery - Discovery - Splunk Enterprise - Splunk Enterprise Security @@ -49,9 +55,32 @@ The following analytic identifies SharpHound binary usage by using the original #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery || [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery || [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | -| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery || [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | +| ----------- | ----------- |--------------- | +| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + + +| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | + + + +| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + +| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | + + + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + +| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + + #### Search @@ -96,7 +125,6 @@ To successfully implement this search you need to be ingesting information on pr False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -105,6 +133,7 @@ False positives should be limited as this is specific to a file attribute not us + #### Reference * [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/) diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md index a806327270..cece372f23 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md @@ -1,6 +1,6 @@ --- title: "Detect AzureHound Command-Line Arguments" -excerpt: "Domain Account, Local Account, Domain Trust Discovery, Domain Groups, Local Groups" +excerpt: "Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery" categories: - Endpoint last_modified_at: 2021-06-01 @@ -11,17 +11,23 @@ tags: - T1087.002 - Domain Account - Discovery - - T1087.001 - - Local Account + - T1069.001 + - Local Groups - Discovery - T1482 - Domain Trust Discovery - Discovery + - T1087.001 + - Local Account + - Discovery + - T1087 + - Account Discovery + - Discovery - T1069.002 - Domain Groups - Discovery - - T1069.001 - - Local Groups + - T1069 + - Permission Groups Discovery - Discovery - Splunk Enterprise - Splunk Enterprise Security @@ -49,9 +55,32 @@ The following analytic identifies the common command-line argument used by Azure #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery || [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery || [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | -| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery || [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | +| ----------- | ----------- |--------------- | +| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + + +| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | + + + +| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + +| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | + + + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + +| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + + #### Search @@ -95,7 +124,6 @@ To successfully implement this search you need to be ingesting information on pr Unknown. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -104,6 +132,7 @@ Unknown. + #### Reference * [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/) diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md index c565783178..09e60af837 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md +++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md @@ -1,6 +1,6 @@ --- title: "Detect AzureHound File Modifications" -excerpt: "Domain Account, Local Account, Domain Trust Discovery, Domain Groups, Local Groups" +excerpt: "Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery" categories: - Endpoint last_modified_at: 2021-06-01 @@ -11,17 +11,23 @@ tags: - T1087.002 - Domain Account - Discovery - - T1087.001 - - Local Account + - T1069.001 + - Local Groups - Discovery - T1482 - Domain Trust Discovery - Discovery + - T1087.001 + - Local Account + - Discovery + - T1087 + - Account Discovery + - Discovery - T1069.002 - Domain Groups - Discovery - - T1069.001 - - Local Groups + - T1069 + - Permission Groups Discovery - Discovery - Splunk Enterprise - Splunk Enterprise Security @@ -49,9 +55,32 @@ The following analytic is similar to SharpHound file modifications, but this ins #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery || [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery || [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | -| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery || [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | +| ----------- | ----------- |--------------- | +| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + + +| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | + + + +| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + +| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | + + + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + +| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + + #### Search @@ -89,7 +118,6 @@ To successfully implement this search you need to be ingesting information on fi False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -98,6 +126,7 @@ False positives should be limited as the analytic is specific to a filename with + #### Reference * [https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350](https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350) diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md index d71a32531e..66f2f44b28 100644 --- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md @@ -1,6 +1,6 @@ --- title: "Detect SharpHound Command-Line Arguments" -excerpt: "Domain Account, Local Account, Domain Trust Discovery, Domain Groups, Local Groups" +excerpt: "Domain Account, Local Groups, Domain Trust Discovery, Local Account, Account Discovery, Domain Groups, Permission Groups Discovery" categories: - Endpoint last_modified_at: 2021-06-01 @@ -11,17 +11,23 @@ tags: - T1087.002 - Domain Account - Discovery - - T1087.001 - - Local Account + - T1069.001 + - Local Groups - Discovery - T1482 - Domain Trust Discovery - Discovery + - T1087.001 + - Local Account + - Discovery + - T1087 + - Account Discovery + - Discovery - T1069.002 - Domain Groups - Discovery - - T1069.001 - - Local Groups + - T1069 + - Permission Groups Discovery - Discovery - Splunk Enterprise - Splunk Enterprise Security @@ -49,9 +55,32 @@ The following analytic identifies common command-line arguments used by SharpHou #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery || [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery || [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | -| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery || [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | +| ----------- | ----------- |--------------- | +| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + + +| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | + + + +| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + +| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | + + + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + +| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + + #### Search @@ -92,7 +121,6 @@ To successfully implement this search you need to be ingesting information on pr False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -101,6 +129,7 @@ False positives should be limited as the arguments used are specific to SharpHou + #### Reference * [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/) diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md index 9410a1daf6..a07bffd30d 100644 --- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md @@ -37,11 +37,14 @@ This search detects the suspicious commandline argument of revil ransomware to e #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search, you need to be ingesting logs with the pr 3rd party tool may have commandline parameter that can trigger this detection. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ To successfully implement this search, you need to be ingesting logs with the pr + #### Reference * [https://malpedia.caad.fkie.fraunhofer.de/details/win.conti](https://malpedia.caad.fkie.fraunhofer.de/details/win.conti) diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index fb1d4cf5fe..9a56f5f2e4 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -37,11 +37,14 @@ This analytic identifies suspicious modification of registry to deface or change #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1491](https://attack.mitre.org/techniques/T1491/) | Defacement | Impact | + + #### Search ``` @@ -81,7 +84,6 @@ To successfully implement this search, you need to be ingesting logs with the Im 3rd party tool may used to changed the wallpaper of the machine - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +92,7 @@ To successfully implement this search, you need to be ingesting logs with the Im + #### Reference * [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/) diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md index 5964cd20c0..d99a0d9568 100644 --- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md @@ -37,11 +37,14 @@ This analytic identifies suspicious commandline parameter that are commonly used #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + #### Search ``` @@ -81,7 +84,6 @@ To successfully implement this search, you need to be ingesting logs with the pr third party tool may have same command line parameters as revil ransomware. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +92,7 @@ third party tool may have same command line parameters as revil ransomware. + #### Reference * [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/) diff --git a/docs/_posts/2021-06-02-revil_registry_entry.md b/docs/_posts/2021-06-02-revil_registry_entry.md index 3204c084e2..ca6f5c20e3 100644 --- a/docs/_posts/2021-06-02-revil_registry_entry.md +++ b/docs/_posts/2021-06-02-revil_registry_entry.md @@ -37,11 +37,14 @@ This analytic identifies suspicious modification in registry entry to keep some #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + + #### Search ``` @@ -78,7 +81,6 @@ to successfully implement this search, you need to be ingesting logs with the Im unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ unknown + #### Reference * [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/) diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index b707c2a634..11faf0cf81 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -1,6 +1,6 @@ --- title: "Wbemprox COM Object Execution" -excerpt: "CMSTP" +excerpt: "Signed Binary Proxy Execution, CMSTP" categories: - Endpoint last_modified_at: 2021-06-02 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.003 - CMSTP - Defense Evasion @@ -37,10 +40,17 @@ this search is designed to detect potential malicious process loading COM object #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | + + + #### Search ``` @@ -80,7 +90,6 @@ To successfully implement this search, you need to be ingesting logs with the pr legitimate process that are not in the exception list may trigger this event. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +98,7 @@ legitimate process that are not in the exception list may trigger this event. + #### Reference * [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/) diff --git a/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md b/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md index 5e8133b9fa..cfa6441a1c 100644 --- a/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md +++ b/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md @@ -37,11 +37,14 @@ This analytic will identify suspicious series of process executions. We have ob #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + #### Search ``` @@ -76,7 +79,6 @@ To successfully implement this search, you need to be ingesting logs with the fu Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ Many benign applications will create processes from executables in Windows\Temp, + #### Reference * [https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index cdf2e6224f..22b22dd023 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -37,11 +37,14 @@ This search detects a suspicioous termination of known services killed by ransom #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | + + #### Search ``` @@ -76,7 +79,6 @@ To successfully implement this search, you need to be ingesting logs with the 70 Admin activities or installing related updates may do a sudden stop to list of services we monitor. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ Admin activities or installing related updates may do a sudden stop to list of s + #### Reference * [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/) diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md index 3996735be5..a51c19bcb0 100644 --- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md +++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md @@ -37,11 +37,14 @@ This detection targets behaviors observed in post exploit kits like Meterpreter #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | + + #### Search ``` @@ -81,7 +84,6 @@ To successfully implement this search you need to be ingesting events related to Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +92,7 @@ Administrators, administrative actions or certain applications may run many inst + #### Reference * [https://attack.mitre.org/software/S0250/](https://attack.mitre.org/software/S0250/) diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md index 1a7f6abe4b..aa6d76b0c8 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md +++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md @@ -1,6 +1,6 @@ --- title: "Powershell Fileless Process Injection via GetProcAddress" -excerpt: "Process Injection, PowerShell" +excerpt: "Command and Scripting Interpreter, Process Injection, PowerShell" categories: - Endpoint last_modified_at: 2021-06-08 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1055 - Process Injection - Defense Evasion @@ -43,11 +46,21 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -82,7 +95,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Limited false positives. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +103,7 @@ Limited false positives. Filter as needed. + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md index ff048dfbf9..e0e20e7e09 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md +++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md @@ -1,6 +1,6 @@ --- title: "Powershell Fileless Script Contains Base64 Encoded Content" -excerpt: "Obfuscated Files or Information, PowerShell" +excerpt: "Command and Scripting Interpreter, Obfuscated Files or Information, PowerShell" categories: - Endpoint last_modified_at: 2021-06-08 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1027 - Obfuscated Files or Information - Defense Evasion @@ -43,11 +46,21 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + + | [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -83,7 +96,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri False positives should be limited. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +104,7 @@ False positives should be limited. Filter as needed. + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md index 2b314a5758..ad5108d0f9 100644 --- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md @@ -1,6 +1,6 @@ --- title: "Detect Empire with PowerShell Script Block Logging" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2021-06-09 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -38,10 +41,17 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ False positives may only pertain to it not being related to Empire, but another + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md index 3ce464651e..c7978172a8 100644 --- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md @@ -38,11 +38,14 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -77,7 +80,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ False positives should be limited as the commands being identifies are quite spe + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md index b904fc1f1b..da22b5a9d6 100644 --- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md +++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md @@ -38,11 +38,14 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + #### Search ``` @@ -77,7 +80,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Potential for some third party applications to disable AMSI upon invocation. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ Potential for some third party applications to disable AMSI upon invocation. Fil + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-10-allow_operation_with_consent_admin.md b/docs/_posts/2021-06-10-allow_operation_with_consent_admin.md index 3d7c8a7cf7..b2477cec69 100644 --- a/docs/_posts/2021-06-10-allow_operation_with_consent_admin.md +++ b/docs/_posts/2021-06-10-allow_operation_with_consent_admin.md @@ -38,11 +38,14 @@ This analytic identifies a potential privilege escalation attempt to perform mal #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + #### Search ``` @@ -77,7 +80,6 @@ To successfully implement this search, you must be ingesting data that records r unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ unknown + #### Reference * [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4) diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md index 147e40dd41..ef49835f3c 100644 --- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md +++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md @@ -1,6 +1,6 @@ --- title: "Clear Unallocated Sector Using Cipher App" -excerpt: "File Deletion" +excerpt: "File Deletion, Indicator Removal on Host" categories: - Endpoint last_modified_at: 2021-06-10 @@ -11,6 +11,9 @@ tags: - T1070.004 - File Deletion - Defense Evasion + - T1070 + - Indicator Removal on Host + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1070.004](https://attack.mitre.org/techniques/T1070/004/) | File Deletion | Defense Evasion | + +| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr administrator may execute this app to manage disk - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ administrator may execute this app to manage disk + #### Reference * [https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/](https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/) diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md index 729771c1ce..2077e0112e 100644 --- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md +++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md @@ -1,6 +1,6 @@ --- title: "Disable Logs Using WevtUtil" -excerpt: "Clear Windows Event Logs" +excerpt: "Indicator Removal on Host, Clear Windows Event Logs" categories: - Endpoint last_modified_at: 2021-06-10 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1070 + - Indicator Removal on Host + - Defense Evasion - T1070.001 - Clear Windows Event Logs - Defense Evasion @@ -37,10 +40,17 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr network operator may disable audit event logs for debugging purposes. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ network operator may disable audit event logs for debugging purposes. + #### Reference * [https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/](https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/) diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md index a38ce2aa67..803154aab2 100644 --- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md +++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md @@ -37,11 +37,14 @@ This search is to detect a modification of file or directory permission using ta #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | + + #### Search ``` @@ -80,7 +83,6 @@ To successfully implement this search, you need to be ingesting logs with the pr takeown.exe is a normal windows application that may used by network operator. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ takeown.exe is a normal windows application that may used by network operator. + #### Reference * [https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/](https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/) diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md index 90f6e77b1c..f3cffb99a0 100644 --- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md +++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md @@ -1,6 +1,6 @@ --- title: "Powershell Creating Thread Mutex" -excerpt: "Indicator Removal from Tools" +excerpt: "Obfuscated Files or Information, Indicator Removal from Tools" categories: - Endpoint last_modified_at: 2021-06-10 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1027 + - Obfuscated Files or Information + - Defense Evasion - T1027.005 - Indicator Removal from Tools - Defense Evasion @@ -36,10 +39,17 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion | + + | [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion | + + + #### Search ``` @@ -73,7 +83,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri powershell developer may used this function in their script for instance checking too. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -82,6 +91,7 @@ powershell developer may used this function in their script for instance checkin + #### Reference * [https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/](https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/) diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md index 6b21279b79..726747cd5b 100644 --- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md +++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md @@ -1,6 +1,6 @@ --- title: "PowerShell Domain Enumeration" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2021-06-10 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -38,10 +41,17 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -74,7 +84,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri It is possible there will be false positives, filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +92,7 @@ It is possible there will be false positives, filter as needed. + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md index 2bf2385c4e..83a444bedf 100644 --- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md +++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md @@ -1,6 +1,6 @@ --- title: "PowerShell Loading DotNET into Memory via System Reflection Assembly" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2021-06-10 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -38,10 +41,17 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri False positives should be limited as day to day scripts do not use this method. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ False positives should be limited as day to day scripts do not use this method. + #### Reference * [https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0) diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md index 3f60968b29..366f2591ab 100644 --- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md +++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md @@ -1,6 +1,6 @@ --- title: "Powershell Processing Stream Of Data" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2021-06-10 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -36,10 +39,17 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -74,7 +84,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri powershell may used this function to process compressed data. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +92,7 @@ powershell may used this function to process compressed data. + #### Reference * [https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9](https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9) diff --git a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md index af96312c02..b260651dc5 100644 --- a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md +++ b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md @@ -36,11 +36,14 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1140](https://attack.mitre.org/techniques/T1140/) | Deobfuscate/Decode Files or Information | Defense Evasion | + + #### Search ``` @@ -74,7 +77,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri powershell may used this function to store out object into memory. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ powershell may used this function to store out object into memory. + #### Reference * [https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/](https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/) diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md index 1bf5da0253..358cfb89ca 100644 --- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md +++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md @@ -37,11 +37,14 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | + + #### Search ``` @@ -80,7 +83,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators may modify the boot configuration ignore failure during testing and debugging. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ Administrators may modify the boot configuration ignore failure during testing a + #### Reference * [https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf](https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf) diff --git a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md index fe898139d5..426c7c0f68 100644 --- a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md +++ b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md @@ -36,11 +36,14 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | + + #### Search ``` @@ -75,7 +78,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri network administrator may used this command for checking purposes - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +86,7 @@ network administrator may used this command for checking purposes + #### Reference * [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/) diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md index 4564c8822e..511930f6e7 100644 --- a/docs/_posts/2021-06-10-recon_using_wmi_class.md +++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md @@ -36,11 +36,14 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | + + #### Search ``` @@ -74,7 +77,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri network administrator may used this command for checking purposes - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ network administrator may used this command for checking purposes + #### Reference * [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/) diff --git a/docs/_posts/2021-06-10-start_up_during_safe_mode_boot.md b/docs/_posts/2021-06-10-start_up_during_safe_mode_boot.md index b860d78977..7716f518ba 100644 --- a/docs/_posts/2021-06-10-start_up_during_safe_mode_boot.md +++ b/docs/_posts/2021-06-10-start_up_during_safe_mode_boot.md @@ -1,6 +1,6 @@ --- title: "Start Up During Safe Mode Boot" -excerpt: "Registry Run Keys / Startup Folder" +excerpt: "Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution" categories: - Endpoint last_modified_at: 2021-06-10 @@ -12,6 +12,10 @@ tags: - Registry Run Keys / Startup Folder - Persistence - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ This search is to detect a modification or registry add to the safeboot registry #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1547.001](https://attack.mitre.org/techniques/T1547/001/) | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation | + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -76,7 +87,6 @@ To successfully implement this search, you must be ingesting data that records r updated windows application needed in safe boot may used this registry - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +95,7 @@ updated windows application needed in safe boot may used this registry + #### Reference * [https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365](https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365) diff --git a/docs/_posts/2021-06-14-deny_permission_using_cacls_utility.md b/docs/_posts/2021-06-14-deny_permission_using_cacls_utility.md index 3d76468fb7..c539ee8d2b 100644 --- a/docs/_posts/2021-06-14-deny_permission_using_cacls_utility.md +++ b/docs/_posts/2021-06-14-deny_permission_using_cacls_utility.md @@ -35,11 +35,14 @@ This analytic identifies a potential adversary that changes the security permiss #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | + + #### Search ``` @@ -76,7 +79,6 @@ To successfully implement this search, you need to be ingesting logs with the pr network administrator may use this windows utility but this is not a common practice. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ network administrator may use this windows utility but this is not a common prac + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-06-14-grant_permission_using_cacls_utility.md b/docs/_posts/2021-06-14-grant_permission_using_cacls_utility.md index 3142758ab9..0f981e24e0 100644 --- a/docs/_posts/2021-06-14-grant_permission_using_cacls_utility.md +++ b/docs/_posts/2021-06-14-grant_permission_using_cacls_utility.md @@ -35,11 +35,14 @@ This analytic identifies potential adversaries that modify the security permissi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | + + #### Search ``` @@ -76,7 +79,6 @@ To successfully implement this search, you need to be ingesting logs with the pr network administrator may use this windows utility but this is not a common practice. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ network administrator may use this windows utility but this is not a common prac + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md index 7b46ac5bc3..7483ea4574 100644 --- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md +++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md @@ -36,11 +36,14 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | + + #### Search ``` @@ -74,7 +77,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri network administrator may used this command for checking purposes - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ network administrator may used this command for checking purposes + #### Reference * [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/) diff --git a/docs/_posts/2021-06-15-modify_acls_permission_of_files_or_folders.md b/docs/_posts/2021-06-15-modify_acls_permission_of_files_or_folders.md index 4e5c3819d5..8b4031c047 100644 --- a/docs/_posts/2021-06-15-modify_acls_permission_of_files_or_folders.md +++ b/docs/_posts/2021-06-15-modify_acls_permission_of_files_or_folders.md @@ -35,11 +35,14 @@ This analytic identifies suspicious modification of ACL permission to a files or #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | + + #### Search ``` @@ -76,7 +79,6 @@ To successfully implement this search, you need to be ingesting logs with the pr network administrator may use this windows utility. filter is needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ network administrator may use this windows utility. filter is needed. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md b/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md index efed70ec90..1a4f0bea2e 100644 --- a/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md +++ b/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md @@ -1,6 +1,6 @@ --- title: "WevtUtil Usage To Clear Logs" -excerpt: "Clear Windows Event Logs" +excerpt: "Indicator Removal on Host, Clear Windows Event Logs" categories: - Endpoint last_modified_at: 2021-06-15 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1070 + - Indicator Removal on Host + - Defense Evasion - T1070.001 - Clear Windows Event Logs - Defense Evasion @@ -35,10 +38,17 @@ The wevtutil.exe application is the windows event log utility. This searches for #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | + + + #### Search ``` @@ -77,7 +87,6 @@ You must be ingesting data that records process activity from your hosts to popu The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ The wevtutil.exe application is a legitimate Windows event log utility. Administ + #### Reference * [https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html](https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html) diff --git a/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md b/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md index c34d070119..96ffa13fad 100644 --- a/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md +++ b/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md @@ -1,6 +1,6 @@ --- title: "Wevtutil Usage To Disable Logs" -excerpt: "Clear Windows Event Logs" +excerpt: "Indicator Removal on Host, Clear Windows Event Logs" categories: - Endpoint last_modified_at: 2021-06-15 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1070 + - Indicator Removal on Host + - Defense Evasion - T1070.001 - Clear Windows Event Logs - Defense Evasion @@ -35,10 +38,17 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | + + + #### Search ``` @@ -76,7 +86,6 @@ You must be ingesting data that records process activity from your hosts to popu network operator may disable audit event logs for debugging purposes. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ network operator may disable audit event logs for debugging purposes. + #### Reference * [https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/](https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/) diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index ced804b45a..1de8111295 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -1,6 +1,6 @@ --- title: "Detect WMI Event Subscription Persistence" -excerpt: "Windows Management Instrumentation Event Subscription" +excerpt: "Windows Management Instrumentation Event Subscription, Event Triggered Execution" categories: - Endpoint last_modified_at: 2021-06-16 @@ -12,6 +12,10 @@ tags: - Windows Management Instrumentation Event Subscription - Privilege Escalation - Persistence + - T1546 + - Event Triggered Execution + - Privilege Escalation + - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -42,10 +46,17 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1546.003](https://attack.mitre.org/techniques/T1546/003/) | Windows Management Instrumentation Event Subscription | Privilege Escalation, Persistence | + +| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Privilege Escalation, Persistence | + + + + + #### Search ``` @@ -78,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with that p It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin's for further depth of coverage. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +97,7 @@ It is possible some applications will create a consumer and may be required to b + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md) diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md index 48fed249bd..e740afd3be 100644 --- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md +++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md @@ -1,6 +1,6 @@ --- title: "Suspicious Event Log Service Behavior" -excerpt: "Clear Windows Event Logs" +excerpt: "Indicator Removal on Host, Clear Windows Event Logs" categories: - Endpoint last_modified_at: 2021-06-17 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1070 + - Indicator Removal on Host + - Defense Evasion - T1070.001 - Clear Windows Event Logs - Defense Evasion @@ -36,10 +39,17 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | + + + #### Search ``` @@ -73,7 +83,6 @@ To successfully implement this search, you need to be ingesting Windows event lo It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -82,6 +91,7 @@ It is possible the Event Logging service gets shut down due to system errors or + #### Reference * [https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100) diff --git a/docs/_posts/2021-06-18-attempt_to_delete_services.md b/docs/_posts/2021-06-18-attempt_to_delete_services.md index 14d3009a4f..2ac84e45c5 100644 --- a/docs/_posts/2021-06-18-attempt_to_delete_services.md +++ b/docs/_posts/2021-06-18-attempt_to_delete_services.md @@ -35,11 +35,14 @@ This analytic identifies suspicious series of attempt to kill multiple services #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | + + #### Search ``` @@ -79,6 +82,7 @@ unknown + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-06-18-attempt_to_disable_services.md b/docs/_posts/2021-06-18-attempt_to_disable_services.md index e57f6cef1c..925fe89c7e 100644 --- a/docs/_posts/2021-06-18-attempt_to_disable_services.md +++ b/docs/_posts/2021-06-18-attempt_to_disable_services.md @@ -35,11 +35,14 @@ This analytic will identify suspicious series of command-line to disable several #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | + + #### Search ``` @@ -80,6 +83,7 @@ unknown + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-06-21-attacker_tools_on_endpoint.md b/docs/_posts/2021-06-21-attacker_tools_on_endpoint.md index 4da564bc85..117419d49d 100644 --- a/docs/_posts/2021-06-21-attacker_tools_on_endpoint.md +++ b/docs/_posts/2021-06-21-attacker_tools_on_endpoint.md @@ -1,6 +1,6 @@ --- title: "Attacker Tools On Endpoint" -excerpt: "Match Legitimate Name or Location, Active Scanning, OS Credential Dumping" +excerpt: "Match Legitimate Name or Location, Masquerading, OS Credential Dumping, Active Scanning" categories: - Endpoint last_modified_at: 2021-06-21 @@ -11,12 +11,15 @@ tags: - T1036.005 - Match Legitimate Name or Location - Defense Evasion - - T1595 - - Active Scanning - - Reconnaissance + - T1036 + - Masquerading + - Defense Evasion - T1003 - OS Credential Dumping - Credential Access + - T1595 + - Active Scanning + - Reconnaissance - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -45,12 +48,25 @@ This search looks for execution of commonly used attacker tools on an endpoint. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | -| [T1036.005](https://attack.mitre.org/techniques/T1036/005/) | Match Legitimate Name or Location | Defense Evasion || [T1595](https://attack.mitre.org/techniques/T1595/) | Active Scanning | Reconnaissance | +| ----------- | ----------- |--------------- | +| [T1036.005](https://attack.mitre.org/techniques/T1036/005/) | Match Legitimate Name or Location | Defense Evasion | + + + +| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + + + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +| [T1595](https://attack.mitre.org/techniques/T1595/) | Active Scanning | Reconnaissance | + + + + + #### Search ``` @@ -91,7 +107,6 @@ To successfully implement this search, you must be ingesting data that records p Some administrator activity can be potentially triggered, please add those users to the filter macro. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -100,6 +115,7 @@ Some administrator activity can be potentially triggered, please add those users + #### Reference diff --git a/docs/_posts/2021-06-21-delete_a_net_user.md b/docs/_posts/2021-06-21-delete_a_net_user.md index cd6c6daa4f..baa5b3ca15 100644 --- a/docs/_posts/2021-06-21-delete_a_net_user.md +++ b/docs/_posts/2021-06-21-delete_a_net_user.md @@ -35,11 +35,14 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | + + #### Search ``` @@ -79,6 +82,7 @@ System administrators or scripts may delete user accounts via this technique. Fi + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-06-21-disable_net_user_account.md b/docs/_posts/2021-06-21-disable_net_user_account.md index a8e9af3997..2e7eec8f25 100644 --- a/docs/_posts/2021-06-21-disable_net_user_account.md +++ b/docs/_posts/2021-06-21-disable_net_user_account.md @@ -35,11 +35,14 @@ This analytic will identify a suspicious command-line that disables a user accou #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | + + #### Search ``` @@ -79,6 +82,7 @@ network operator may use this approach to quickly disable an account but not a c + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-06-21-resize_shadowstorage_volume.md b/docs/_posts/2021-06-21-resize_shadowstorage_volume.md index 3b7bf7e057..41da3d1c77 100644 --- a/docs/_posts/2021-06-21-resize_shadowstorage_volume.md +++ b/docs/_posts/2021-06-21-resize_shadowstorage_volume.md @@ -35,11 +35,14 @@ The following analytics identifies the resizing of shadowstorage by ransomware m #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | + + #### Search ``` @@ -79,6 +82,7 @@ network admin can resize the shadowstorage for valid purposes. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-06-22-disable_amsi_through_registry.md b/docs/_posts/2021-06-22-disable_amsi_through_registry.md index cab9839222..97d77d5db0 100644 --- a/docs/_posts/2021-06-22-disable_amsi_through_registry.md +++ b/docs/_posts/2021-06-22-disable_amsi_through_registry.md @@ -1,6 +1,6 @@ --- title: "Disable AMSI Through Registry" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-06-22 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ this search is to identify modification in registry to disable AMSI windows feat #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -78,6 +88,7 @@ network operator may disable this feature of windows but not so common. + #### Reference * [https://blog.f-secure.com/hunting-for-amsi-bypasses/](https://blog.f-secure.com/hunting-for-amsi-bypasses/) diff --git a/docs/_posts/2021-06-22-disable_etw_through_registry.md b/docs/_posts/2021-06-22-disable_etw_through_registry.md index d043123630..08cadb7c0f 100644 --- a/docs/_posts/2021-06-22-disable_etw_through_registry.md +++ b/docs/_posts/2021-06-22-disable_etw_through_registry.md @@ -1,6 +1,6 @@ --- title: "Disable ETW Through Registry" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-06-22 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ this search is to identify modification in registry to disable ETW windows featu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -78,6 +88,7 @@ network operator may disable this feature of windows but not so common. + #### Reference * [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/) diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md index 9fe88b96c8..fe0f0bfdbc 100644 --- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md +++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md @@ -1,6 +1,6 @@ --- title: "Execute Javascript With Jscript COM CLSID" -excerpt: "Visual Basic" +excerpt: "Command and Scripting Interpreter, Visual Basic" categories: - Endpoint last_modified_at: 2021-06-22 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.005 - Visual Basic - Execution @@ -37,10 +40,17 @@ This analytic will identify suspicious process of cscript.exe where it tries to #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.005](https://attack.mitre.org/techniques/T1059/005/) | Visual Basic | Execution | + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ unknown + #### Reference * [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/) diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md index b28e216ca0..2f8caebced 100644 --- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md +++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md @@ -1,6 +1,6 @@ --- title: "Powershell Enable SMB1Protocol Feature" -excerpt: "Indicator Removal from Tools" +excerpt: "Obfuscated Files or Information, Indicator Removal from Tools" categories: - Endpoint last_modified_at: 2021-06-22 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1027 + - Obfuscated Files or Information + - Defense Evasion - T1027.005 - Indicator Removal from Tools - Defense Evasion @@ -37,10 +40,17 @@ This search is to detect a suspicious enabling of smb1protocol through "powe #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion | + + | [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion | + + + #### Search ``` @@ -77,6 +87,7 @@ network operator may enable or disable this windows feature. + #### Reference * [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/) diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index c717105ff9..5ce6e73586 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -1,6 +1,6 @@ --- title: "Recursive Delete of Directory In Batch CMD" -excerpt: "File Deletion" +excerpt: "File Deletion, Indicator Removal on Host" categories: - Endpoint last_modified_at: 2021-06-22 @@ -11,6 +11,9 @@ tags: - T1070.004 - File Deletion - Defense Evasion + - T1070 + - Indicator Removal on Host + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect a suspicious commandline designed to delete files or di #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1070.004](https://attack.mitre.org/techniques/T1070/004/) | File Deletion | Defense Evasion | + +| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + + + + #### Search ``` @@ -84,6 +94,7 @@ network operator may use this batch command to delete recursively a directory or + #### Reference * [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/) diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index b8eaebe8d7..43dd1e4233 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -1,6 +1,6 @@ --- title: "Allow File And Printing Sharing In Firewall" -excerpt: "Disable or Modify Cloud Firewall" +excerpt: "Disable or Modify Cloud Firewall, Impair Defenses" categories: - Endpoint last_modified_at: 2021-06-23 @@ -11,6 +11,9 @@ tags: - T1562.007 - Disable or Modify Cloud Firewall - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect a suspicious modification of firewall to allow file and #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -84,6 +94,7 @@ network admin may modify this firewall feature that may cause this rule to be tr + #### Reference * [https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469](https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469) diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index 05262c1467..c422c8d179 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -1,6 +1,6 @@ --- title: "Allow Network Discovery In Firewall" -excerpt: "Disable or Modify Cloud Firewall" +excerpt: "Disable or Modify Cloud Firewall, Impair Defenses" categories: - Endpoint last_modified_at: 2021-06-23 @@ -11,6 +11,9 @@ tags: - T1562.007 - Disable or Modify Cloud Firewall - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect a suspicious modification to the firewall to allow netw #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -85,6 +95,7 @@ network admin may modify this firewall feature that may cause this rule to be tr + #### Reference * [https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469](https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469) diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index 6a948faeb5..17886f3ae8 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -1,6 +1,6 @@ --- title: "Excessive Usage Of SC Service Utility" -excerpt: "Service Execution" +excerpt: "System Services, Service Execution" categories: - Endpoint last_modified_at: 2021-06-24 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Anomaly + - T1569 + - System Services + - Execution - T1569.002 - Service Execution - Execution @@ -37,10 +40,17 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution | + + | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | + + + #### Search ``` @@ -80,6 +90,7 @@ excessive execution of sc.exe is quite suspicious since it can modify or execute + #### Reference * [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/) diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md index 84ee6013be..0d73410d67 100644 --- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md +++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md @@ -1,6 +1,6 @@ --- title: "Excessive number of service control start as disabled" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-06-25 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This detection targets behaviors observed when threat actors have used sc.exe to #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -79,7 +89,6 @@ You must be ingesting data that records process activity from your hosts to popu Legitimate programs and administrators will execute sc.exe with the start disabled flag. It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ Legitimate programs and administrators will execute sc.exe with the start disabl + #### Reference * [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create) diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index dc6044b3cb..6a8a3eb757 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -1,6 +1,6 @@ --- title: "Print Spooler Adding A Printer Driver" -excerpt: "Print Processors" +excerpt: "Print Processors, Boot or Logon Autostart Execution" categories: - Endpoint last_modified_at: 2021-07-01 @@ -12,9 +12,15 @@ tags: - Print Processors - Persistence - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-34527 + - CVE-2021-1675 - Endpoint - Exploitation --- @@ -40,10 +46,17 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -77,7 +90,6 @@ You will need to ensure PrintService Admin and Operational logs are being logged Unknown. This may require filtering. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +98,15 @@ Unknown. This may require filtering. +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | +| [CVE-2021-1675](https://nvd.nist.gov/vuln/detail/CVE-2021-1675) | Windows Print Spooler Elevation of Privilege Vulnerability | 9.3 | + + + #### Reference * [https://twitter.com/MalwareJake/status/1410421445608476679?s=20](https://twitter.com/MalwareJake/status/1410421445608476679?s=20) diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index 71a000e8e4..60257f25e7 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -1,6 +1,6 @@ --- title: "Print Spooler Failed to Load a Plug-in" -excerpt: "Print Processors" +excerpt: "Print Processors, Boot or Logon Autostart Execution" categories: - Endpoint last_modified_at: 2021-07-01 @@ -12,9 +12,15 @@ tags: - Print Processors - Persistence - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-34527 + - CVE-2021-1675 - Endpoint - Exploitation --- @@ -41,10 +47,17 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -78,7 +91,6 @@ You will need to ensure PrintService Admin and Operational logs are being logged False positives are unknown and filtering may be required. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +99,15 @@ False positives are unknown and filtering may be required. +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | +| [CVE-2021-1675](https://nvd.nist.gov/vuln/detail/CVE-2021-1675) | Windows Print Spooler Elevation of Privilege Vulnerability | 9.3 | + + + #### Reference * [https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/](https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/) diff --git a/docs/_posts/2021-07-01-sdclt_uac_bypass.md b/docs/_posts/2021-07-01-sdclt_uac_bypass.md index 07ed7791a4..e747dd8544 100644 --- a/docs/_posts/2021-07-01-sdclt_uac_bypass.md +++ b/docs/_posts/2021-07-01-sdclt_uac_bypass.md @@ -1,6 +1,6 @@ --- title: "Sdclt UAC Bypass" -excerpt: "Bypass User Account Control" +excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism" categories: - Endpoint last_modified_at: 2021-07-01 @@ -12,6 +12,10 @@ tags: - Bypass User Account Control - Privilege Escalation - Defense Evasion + - T1548 + - Abuse Elevation Control Mechanism + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | + +| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -76,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr Limited to no false positives are expected. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +95,7 @@ Limited to no false positives are expected. + #### Reference * [https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/](https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/) diff --git a/docs/_posts/2021-07-01-silentcleanup_uac_bypass.md b/docs/_posts/2021-07-01-silentcleanup_uac_bypass.md index d3b7d2e1e7..99354c16fc 100644 --- a/docs/_posts/2021-07-01-silentcleanup_uac_bypass.md +++ b/docs/_posts/2021-07-01-silentcleanup_uac_bypass.md @@ -1,6 +1,6 @@ --- title: "SilentCleanup UAC Bypass" -excerpt: "Bypass User Account Control" +excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism" categories: - Endpoint last_modified_at: 2021-07-01 @@ -12,6 +12,10 @@ tags: - Bypass User Account Control - Privilege Escalation - Defense Evasion + - T1548 + - Abuse Elevation Control Mechanism + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ This search is to detect a suspicious modification of registry that may related #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | + +| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -76,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +95,7 @@ unknown + #### Reference * [https://github.com/hfiref0x/UACME](https://github.com/hfiref0x/UACME) diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index da293dfadc..d45dd0243e 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -1,6 +1,6 @@ --- title: "Spoolsv Spawning Rundll32" -excerpt: "Print Processors" +excerpt: "Print Processors, Boot or Logon Autostart Execution" categories: - Endpoint last_modified_at: 2021-07-01 @@ -12,9 +12,14 @@ tags: - Print Processors - Persistence - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-34527 - Endpoint - Exploitation --- @@ -38,10 +43,17 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -83,7 +95,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +103,14 @@ Limited false positives have been identified. There are limited instances where +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | + + + #### Reference * [https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/](https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/) diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index 0d14ec3e0c..ebcd4f8e1d 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -1,6 +1,6 @@ --- title: "Spoolsv Suspicious Loaded Modules" -excerpt: "Print Processors" +excerpt: "Print Processors, Boot or Logon Autostart Execution" categories: - Endpoint last_modified_at: 2021-07-01 @@ -12,9 +12,14 @@ tags: - Print Processors - Persistence - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-34527 - Endpoint - Exploitation --- @@ -38,10 +43,17 @@ This search is to detect suspicious loading of dll in specific path relative to #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -76,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +96,14 @@ unknown +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | + + + #### Reference * [https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml](https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml) diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index 1f56f9828a..7f9c8baefd 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-34527 - Endpoint - Exploitation --- @@ -37,11 +38,14 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | + + #### Search ``` @@ -76,7 +80,6 @@ To successfully implement this search, you need to be ingesting logs with proces Unknown. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +88,14 @@ Unknown. Filter as needed. +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | + + + #### Reference * [https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818](https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818) diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md index f5fa863333..37c6cd2af3 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md @@ -1,6 +1,6 @@ --- title: "Spoolsv Writing a DLL" -excerpt: "Print Processors" +excerpt: "Print Processors, Boot or Logon Autostart Execution" categories: - Endpoint last_modified_at: 2021-07-01 @@ -12,9 +12,14 @@ tags: - Print Processors - Persistence - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-34527 - Endpoint - Exploitation --- @@ -38,10 +43,17 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -84,7 +96,6 @@ To successfully implement this search you need to be ingesting information on pr Unknown. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +104,14 @@ Unknown. +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | + + + #### Reference * [https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/](https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/) diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index 2101932568..5d372ff96b 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -1,6 +1,6 @@ --- title: "Spoolsv Writing a DLL - Sysmon" -excerpt: "Print Processors" +excerpt: "Print Processors, Boot or Logon Autostart Execution" categories: - Endpoint last_modified_at: 2021-07-01 @@ -12,9 +12,14 @@ tags: - Print Processors - Persistence - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-34527 - Endpoint - Exploitation --- @@ -38,10 +43,17 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + #### Search ``` @@ -77,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Limited false positives. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +97,14 @@ Limited false positives. Filter as needed. +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | + + + #### Reference * [https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818](https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818) diff --git a/docs/_posts/2021-07-01-wsreset_uac_bypass.md b/docs/_posts/2021-07-01-wsreset_uac_bypass.md index f8695fb529..686ebf2a93 100644 --- a/docs/_posts/2021-07-01-wsreset_uac_bypass.md +++ b/docs/_posts/2021-07-01-wsreset_uac_bypass.md @@ -1,6 +1,6 @@ --- title: "WSReset UAC Bypass" -excerpt: "Bypass User Account Control" +excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism" categories: - Endpoint last_modified_at: 2021-07-01 @@ -12,6 +12,10 @@ tags: - Bypass User Account Control - Privilege Escalation - Defense Evasion + - T1548 + - Abuse Elevation Control Mechanism + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ This search is to detect a suspicious modification of registry related to UAC by #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | + +| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -76,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +95,7 @@ unknown + #### Reference * [https://github.com/hfiref0x/UACME](https://github.com/hfiref0x/UACME) diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md index 04ff2f179e..c98bea3bc2 100644 --- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md +++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md @@ -1,6 +1,6 @@ --- title: "Msmpeng Application DLL Side Loading" -excerpt: "DLL Side-Loading" +excerpt: "DLL Side-Loading, Hijack Execution Flow" categories: - Endpoint last_modified_at: 2021-07-05 @@ -13,6 +13,11 @@ tags: - Persistence - Privilege Escalation - Defense Evasion + - T1574 + - Hijack Execution Flow + - Persistence + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -39,10 +44,17 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1574.002](https://attack.mitre.org/techniques/T1574/002/) | DLL Side-Loading | Persistence, Privilege Escalation, Defense Evasion | + +| [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -81,6 +93,7 @@ quite minimal false positive expected. + #### Reference * [https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers](https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers) diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index df03495eb4..0bdbdf88c6 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -1,6 +1,6 @@ --- title: "Powershell Disable Security Monitoring" -excerpt: "Disable or Modify Tools" +excerpt: "Disable or Modify Tools, Impair Defenses" categories: - Endpoint last_modified_at: 2021-07-05 @@ -11,6 +11,9 @@ tags: - T1562.001 - Disable or Modify Tools - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to identifies a modification in registry to disable the windows d #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -85,6 +95,7 @@ Limited false positives. However, tune based on scripts that may perform this ac + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell) diff --git a/docs/_posts/2021-07-12-net_profiler_uac_bypass.md b/docs/_posts/2021-07-12-net_profiler_uac_bypass.md index 63d0ace49f..1217a00a34 100644 --- a/docs/_posts/2021-07-12-net_profiler_uac_bypass.md +++ b/docs/_posts/2021-07-12-net_profiler_uac_bypass.md @@ -1,6 +1,6 @@ --- title: "NET Profiler UAC bypass" -excerpt: "Bypass User Account Control" +excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism" categories: - Endpoint last_modified_at: 2021-07-12 @@ -12,6 +12,10 @@ tags: - Bypass User Account Control - Privilege Escalation - Defense Evasion + - T1548 + - Abuse Elevation Control Mechanism + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ This search is to detect modification of registry to bypass UAC windows feature. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | + +| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -76,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr limited false positive. It may trigger by some windows update that will modify this registry. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +95,7 @@ limited false positive. It may trigger by some windows update that will modify t + #### Reference * [https://offsec.almond.consulting/UAC-bypass-dotnet.html](https://offsec.almond.consulting/UAC-bypass-dotnet.html) diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index 4f0fc6fd35..d45c9345ff 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -1,6 +1,6 @@ --- title: "UAC Bypass MMC Load Unsigned Dll" -excerpt: "Bypass User Account Control" +excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism" categories: - Endpoint last_modified_at: 2021-07-12 @@ -12,6 +12,10 @@ tags: - Bypass User Account Control - Privilege Escalation - Defense Evasion + - T1548 + - Abuse Elevation Control Mechanism + - Privilege Escalation + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | + +| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + + + #### Search ``` @@ -79,7 +90,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown. all of the dll loaded by mmc.exe is microsoft signed dll. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +98,7 @@ unknown. all of the dll loaded by mmc.exe is microsoft signed dll. + #### Reference * [https://offsec.almond.consulting/UAC-bypass-dotnet.html](https://offsec.almond.consulting/UAC-bypass-dotnet.html) diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md index b8859f83c1..f13fd8ac0d 100644 --- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md +++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md @@ -1,6 +1,6 @@ --- title: "Cloud Compute Instance Created By Previously Unseen User" -excerpt: "Cloud Accounts" +excerpt: "Cloud Accounts, Valid Accounts" categories: - Cloud last_modified_at: 2021-07-13 @@ -14,6 +14,12 @@ tags: - Persistence - Privilege Escalation - Initial Access + - T1078 + - Valid Accounts + - Defense Evasion + - Persistence + - Privilege Escalation + - Initial Access - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -40,10 +46,17 @@ This search looks for cloud compute instances created by users who have not crea #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + +| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | + + + + + #### Search ``` @@ -82,7 +95,6 @@ You must be ingesting the appropriate cloud-infrastructure logs Run the "Pre It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +103,7 @@ It's possible that a user will start to create compute instances for the fir + #### Reference diff --git a/docs/_posts/2021-07-19-aws_createaccesskey.md b/docs/_posts/2021-07-19-aws_createaccesskey.md index 0f03e49a55..bc173e0572 100644 --- a/docs/_posts/2021-07-19-aws_createaccesskey.md +++ b/docs/_posts/2021-07-19-aws_createaccesskey.md @@ -1,6 +1,6 @@ --- title: "AWS CreateAccessKey" -excerpt: "Cloud Account" +excerpt: "Cloud Account, Create Account" categories: - Cloud last_modified_at: 2021-07-19 @@ -11,6 +11,9 @@ tags: - T1136.003 - Cloud Account - Persistence + - T1136 + - Create Account + - Persistence - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | + +| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | + + + + + #### Search ``` @@ -75,7 +85,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ While this search has no known false positives, it is possible that an AWS admin + #### Reference * [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws) diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md index c7bf324555..a91625c452 100644 --- a/docs/_posts/2021-07-19-aws_createloginprofile.md +++ b/docs/_posts/2021-07-19-aws_createloginprofile.md @@ -1,6 +1,6 @@ --- title: "AWS CreateLoginProfile" -excerpt: "Cloud Account" +excerpt: "Cloud Account, Create Account" categories: - Cloud last_modified_at: 2021-07-19 @@ -11,6 +11,9 @@ tags: - T1136.003 - Cloud Account - Persistence + - T1136 + - Create Account + - Persistence - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | + +| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | + + + + + #### Search ``` @@ -79,7 +89,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ While this search has no known false positives, it is possible that an AWS admin + #### Reference * [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws) diff --git a/docs/_posts/2021-07-19-aws_updateloginprofile.md b/docs/_posts/2021-07-19-aws_updateloginprofile.md index a3b4b0d9e1..0723962462 100644 --- a/docs/_posts/2021-07-19-aws_updateloginprofile.md +++ b/docs/_posts/2021-07-19-aws_updateloginprofile.md @@ -1,6 +1,6 @@ --- title: "AWS UpdateLoginProfile" -excerpt: "Cloud Account" +excerpt: "Cloud Account, Create Account" categories: - Cloud last_modified_at: 2021-07-19 @@ -11,6 +11,9 @@ tags: - T1136.003 - Cloud Account - Persistence + - T1136 + - Create Account + - Persistence - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | + +| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | + + + + + #### Search ``` @@ -75,7 +85,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ While this search has no known false positives, it is possible that an AWS admin + #### Reference * [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws) diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md index 5aa9399ef8..933f071927 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md @@ -37,11 +37,14 @@ This search looks for AWS CloudTrail events where a user has created an open/pub #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | + + #### Search ``` @@ -88,7 +91,6 @@ You must install the AWS App for Splunk. While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -97,6 +99,7 @@ While this search has no known false positives, it is possible that an AWS admin + #### Reference diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md index 6f5fe63a7a..c69f5856f2 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md @@ -37,11 +37,14 @@ This search looks for AWS CloudTrail events where a user has created an open/pub #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | + + #### Search ``` @@ -84,7 +87,6 @@ This search looks for AWS CloudTrail events where a user has created an open/pub While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +95,7 @@ While this search has no known false positives, it is possible that an AWS admin + #### Reference diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 3f2c99e795..0872a5a05e 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -1,6 +1,6 @@ --- title: "Mshta spawning Rundll32 OR Regsvr32 Process" -excerpt: "Mshta" +excerpt: "Signed Binary Proxy Execution, Mshta" categories: - Endpoint last_modified_at: 2021-07-19 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.005 - Mshta - Defense Evasion @@ -37,10 +40,17 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr limitted. this anomaly behavior is not commonly seen in clean host. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ limitted. this anomaly behavior is not commonly seen in clean host. + #### Reference * [https://twitter.com/cyb3rops/status/1416050325870587910?s=21](https://twitter.com/cyb3rops/status/1416050325870587910?s=21) diff --git a/docs/_posts/2021-07-19-o365_bypass_mfa_via_trusted_ip.md b/docs/_posts/2021-07-19-o365_bypass_mfa_via_trusted_ip.md index 7b8da829c6..f859b5a7ab 100644 --- a/docs/_posts/2021-07-19-o365_bypass_mfa_via_trusted_ip.md +++ b/docs/_posts/2021-07-19-o365_bypass_mfa_via_trusted_ip.md @@ -1,6 +1,6 @@ --- title: "O365 Bypass MFA via Trusted IP" -excerpt: "Disable or Modify Cloud Firewall" +excerpt: "Disable or Modify Cloud Firewall, Impair Defenses" categories: - Cloud last_modified_at: 2021-07-19 @@ -11,6 +11,9 @@ tags: - T1562.007 - Disable or Modify Cloud Firewall - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Security Analytics for AWS - Splunk Enterprise - Splunk Enterprise Security @@ -37,10 +40,17 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -84,7 +94,6 @@ You must install Splunk Microsoft Office 365 add-on. This search works with o365 Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ Unless it is a special case, it is uncommon to continually update Trusted IPs to + #### Reference * [https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf](https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf) diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 8842e242a3..0332183491 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -1,6 +1,6 @@ --- title: "Office Product Spawn CMD Process" -excerpt: "Mshta" +excerpt: "Signed Binary Proxy Execution, Mshta" categories: - Endpoint last_modified_at: 2021-07-19 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.005 - Mshta - Defense Evasion @@ -37,10 +40,17 @@ this search is to detect a suspicious office product process that spawn cmd chil #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr IT or network admin may create an document automation that will run shell script. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ IT or network admin may create an document automation that will run shell script + #### Reference * [https://twitter.com/cyb3rops/status/1416050325870587910?s=21](https://twitter.com/cyb3rops/status/1416050325870587910?s=21) diff --git a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md index 9aa919acb6..ba52160ed9 100644 --- a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md +++ b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md @@ -37,11 +37,14 @@ The following analytic utilizes AWS CloudTrail events to identify when an EC2 sn #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1537](https://attack.mitre.org/techniques/T1537/) | Transfer Data to Cloud Account | Exfiltration | + + #### Search ``` @@ -81,7 +84,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +92,7 @@ It is possible that an AWS admin has legitimately shared a snapshot with others + #### Reference * [https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/](https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/) diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md index d5d936ed38..5fffc2990a 100644 --- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md +++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md @@ -1,6 +1,6 @@ --- title: "Detect Copy of ShadowCopy with Script Block Logging" -excerpt: "Security Account Manager" +excerpt: "Security Account Manager, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-07-21 @@ -11,9 +11,13 @@ tags: - T1003.002 - Security Account Manager - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-36934 - Exploitation --- @@ -38,10 +42,17 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -76,7 +87,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +95,14 @@ Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hive +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-36934](https://nvd.nist.gov/vuln/detail/CVE-2021-36934) | Windows Elevation of Privilege Vulnerability | 4.6 | + + + #### Reference * [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934) diff --git a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md index fa08150c7b..0ccafdc26a 100644 --- a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md +++ b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md @@ -1,6 +1,6 @@ --- title: "SAM Database File Access Attempt" -excerpt: "Security Account Manager" +excerpt: "Security Account Manager, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-07-23 @@ -11,9 +11,13 @@ tags: - T1003.002 - Security Account Manager - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-36934 - Endpoint - Exploitation --- @@ -37,10 +41,17 @@ The following analytic identifies access to SAM, SYSTEM or SECURITY databases #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -72,7 +83,6 @@ To successfully implement this search, you must ingest Windows Security Event lo Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -81,6 +91,14 @@ Natively, `dllhost.exe` will access the files. Every environment will have addit +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-36934](https://nvd.nist.gov/vuln/detail/CVE-2021-36934) | Windows Elevation of Privilege Vulnerability | 4.6 | + + + #### Reference * [https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663) diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index 7a575fad24..ac0e89d349 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -38,11 +38,14 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this search, you need to be ingesting logs with the So unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ unknown + #### Reference * [https://www.joesandbox.com/analysis/380662/0/html](https://www.joesandbox.com/analysis/380662/0/html) diff --git a/docs/_posts/2021-07-26-rundll32_dnsquery.md b/docs/_posts/2021-07-26-rundll32_dnsquery.md index 6ff9d542e1..a60438ed36 100644 --- a/docs/_posts/2021-07-26-rundll32_dnsquery.md +++ b/docs/_posts/2021-07-26-rundll32_dnsquery.md @@ -1,6 +1,6 @@ --- title: "Rundll32 DNSQuery" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-07-26 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion @@ -37,10 +40,17 @@ This search is to detect a suspicious rundll32.exe process having a http connect #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ unknown + #### Reference * [https://any.run/malware-trends/icedid](https://any.run/malware-trends/icedid) diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index 69407547e0..80b2627202 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -1,6 +1,6 @@ --- title: "Rundll32 Process Creating Exe Dll Files" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-07-26 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion @@ -37,10 +40,17 @@ This search is to detect a suspicious rundll32 process that drops executable (.e #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -75,7 +85,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ unknown + #### Reference * [https://any.run/malware-trends/icedid](https://any.run/malware-trends/icedid) diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index c6ee931414..20dc89d115 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -1,6 +1,6 @@ --- title: "Suspicious IcedID Rundll32 Cmdline" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-07-26 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion @@ -37,10 +40,17 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr limitted. this parameter is not commonly used by windows application but can be used by the network operator. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ limitted. this parameter is not commonly used by windows application but can be + #### Reference * [https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/](https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/) diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index 0ccdb4c52d..f98966bc0d 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -1,6 +1,6 @@ --- title: "Suspicious Rundll32 PluginInit" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-07-26 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion @@ -37,10 +40,17 @@ This search is to detect a suspicious rundll32.exe process with plugininit param #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr third party application may used this dll export name to execute function. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ third party application may used this dll export name to execute function. + #### Reference * [https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/](https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/) diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md index 2b536aad74..f6966757ff 100644 --- a/docs/_posts/2021-07-27-chcp_command_execution.md +++ b/docs/_posts/2021-07-27-chcp_command_execution.md @@ -37,11 +37,14 @@ This search is to detect execution of chcp.exe application. this utility is used #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + #### Search ``` @@ -80,7 +83,6 @@ To successfully implement this search, you need to be ingesting logs with the pr other tools or script may used this to change code page to UTF-* or others - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ other tools or script may used this to change code page to UTF-* or others + #### Reference * [https://ss64.com/nt/chcp.html](https://ss64.com/nt/chcp.html) diff --git a/docs/_posts/2021-07-27-suspicious_icedid_regsvr32_cmdline.md b/docs/_posts/2021-07-27-suspicious_icedid_regsvr32_cmdline.md index bb5b7dd6cf..8c07f19b92 100644 --- a/docs/_posts/2021-07-27-suspicious_icedid_regsvr32_cmdline.md +++ b/docs/_posts/2021-07-27-suspicious_icedid_regsvr32_cmdline.md @@ -1,6 +1,6 @@ --- title: "Suspicious IcedID Regsvr32 Cmdline" -excerpt: "Regsvr32" +excerpt: "Signed Binary Proxy Execution, Regsvr32" categories: - Endpoint last_modified_at: 2021-07-27 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.010 - Regsvr32 - Defense Evasion @@ -37,10 +40,17 @@ this search is to detect a suspicious regsvr32 commandline "-s" to execu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr minimal. but network operator can use this application to load dll. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ minimal. but network operator can use this application to load dll. + #### Reference * [https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/](https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/) diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index caf80025af..7b891505e2 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -38,11 +38,14 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this search, you need to be ingesting logs with the So unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ unknown + #### Reference * [https://www.joesandbox.com/analysis/380662/0/html](https://www.joesandbox.com/analysis/380662/0/html) diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index c9e4642fc3..16772e39fc 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -1,6 +1,6 @@ --- title: "Drop IcedID License dat" -excerpt: "Malicious File" +excerpt: "User Execution, Malicious File" categories: - Endpoint last_modified_at: 2021-07-30 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1204 + - User Execution + - Execution - T1204.002 - Malicious File - Execution @@ -37,10 +40,17 @@ This search is to detect dropping a suspicious file named as "license.dat #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + | [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution | + + + #### Search ``` @@ -70,7 +80,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -79,6 +88,7 @@ unknown + #### Reference * [https://www.cisecurity.org/white-papers/security-primer-icedid/](https://www.cisecurity.org/white-papers/security-primer-icedid/) diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index eeb3675e0c..277ddc306f 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -1,6 +1,6 @@ --- title: "IcedID Exfiltrated Archived File Creation" -excerpt: "Archive via Utility" +excerpt: "Archive via Utility, Archive Collected Data" categories: - Endpoint last_modified_at: 2021-07-30 @@ -11,6 +11,9 @@ tags: - T1560.001 - Archive via Utility - Collection + - T1560 + - Archive Collected Data + - Collection - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect a suspicious file creation namely passff.tar and cookie #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1560.001](https://attack.mitre.org/techniques/T1560/001/) | Archive via Utility | Collection | + +| [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection | + + + + + #### Search ``` @@ -75,7 +85,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ unknown + #### Reference * [https://www.cisecurity.org/white-papers/security-primer-icedid/](https://www.cisecurity.org/white-papers/security-primer-icedid/) diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index 2b3a6eb92a..88c5c9d6f5 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -1,6 +1,6 @@ --- title: "Office Application Spawn Regsvr32 process" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-07-30 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ this detection was designed to identifies suspicious spawned process of known MS #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ unknown + #### Reference * [https://www.joesandbox.com/analysis/380662/0/html](https://www.joesandbox.com/analysis/380662/0/html) diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index 0949545b97..328cac0ff6 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -37,11 +37,14 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1005](https://attack.mitre.org/techniques/T1005/) | Data from Local System | Collection | + + #### Search ``` @@ -76,7 +79,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ unknown + #### Reference * [https://www.cisecurity.org/white-papers/security-primer-icedid/](https://www.cisecurity.org/white-papers/security-primer-icedid/) diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index 6fb090354b..1fc40935e3 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -38,11 +38,14 @@ This search is to detect suspicious process injection in command shell. This tec #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ unknown + #### Reference * [https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/](https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/) diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md index d16b9ce54a..196a8bb219 100644 --- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md +++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md @@ -1,6 +1,6 @@ --- title: "Uninstall App Using MsiExec" -excerpt: "Msiexec" +excerpt: "Msiexec, Signed Binary Proxy Execution" categories: - Endpoint last_modified_at: 2021-08-09 @@ -11,6 +11,9 @@ tags: - T1218.007 - Msiexec - Defense Evasion + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect a suspicious un-installation of application using msiex #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1218.007](https://attack.mitre.org/techniques/T1218/007/) | Msiexec | Defense Evasion | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ unknown. + #### Reference * [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html) diff --git a/docs/_posts/2021-08-10-powershell_execute_com_object.md b/docs/_posts/2021-08-10-powershell_execute_com_object.md index 03e85b4933..5eb67f3dce 100644 --- a/docs/_posts/2021-08-10-powershell_execute_com_object.md +++ b/docs/_posts/2021-08-10-powershell_execute_com_object.md @@ -1,6 +1,6 @@ --- title: "Powershell Execute COM Object" -excerpt: "Component Object Model Hijacking" +excerpt: "Component Object Model Hijacking, Event Triggered Execution" categories: - Endpoint last_modified_at: 2021-08-10 @@ -12,6 +12,10 @@ tags: - Component Object Model Hijacking - Privilege Escalation - Persistence + - T1546 + - Event Triggered Execution + - Privilege Escalation + - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +42,17 @@ This search is to detect a COM CLSID execution through powershell. This techniqu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1546.015](https://attack.mitre.org/techniques/T1546/015/) | Component Object Model Hijacking | Privilege Escalation, Persistence | + +| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Privilege Escalation, Persistence | + + + + + #### Search ``` @@ -72,7 +83,6 @@ To successfully implement this search, you need to be ingesting logs with the pr network operrator may use this command. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -81,6 +91,7 @@ network operrator may use this command. + #### Reference * [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html) diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md index db974b5bce..3339661254 100644 --- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md +++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md @@ -37,11 +37,14 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + #### Search ``` @@ -78,7 +81,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ unknown + #### Reference * [https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/](https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/) diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index c0cc1c4199..e7fe91d48b 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -1,6 +1,6 @@ --- title: "UAC Bypass With Colorui COM Object" -excerpt: "CMSTP" +excerpt: "Signed Binary Proxy Execution, CMSTP" categories: - Endpoint last_modified_at: 2021-08-13 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.003 - CMSTP - Defense Evasion @@ -37,10 +40,17 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | + + + #### Search ``` @@ -77,7 +87,6 @@ To successfully implement this search, you need to be ingesting logs with the pr not so common. but 3rd part app may load this dll. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ not so common. but 3rd part app may load this dll. + #### Reference * [https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/](https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/) diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md index afe54bd61a..edfaf5703c 100644 --- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md +++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md @@ -1,6 +1,6 @@ --- title: "Gsuite Drive Share In External Email" -excerpt: "Exfiltration to Cloud Storage" +excerpt: "Exfiltration to Cloud Storage, Exfiltration Over Web Service" categories: - Cloud last_modified_at: 2021-08-16 @@ -11,6 +11,9 @@ tags: - T1567.002 - Exfiltration to Cloud Storage - Exfiltration + - T1567 + - Exfiltration Over Web Service + - Exfiltration - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect suspicious google drive or google docs files shared out #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1567.002](https://attack.mitre.org/techniques/T1567/002/) | Exfiltration to Cloud Storage | Exfiltration | + +| [T1567](https://attack.mitre.org/techniques/T1567/) | Exfiltration Over Web Service | Exfiltration | + + + + + #### Search ``` @@ -58,11 +68,11 @@ This search is to detect suspicious google drive or google docs files shared out ``` #### Associated Analytic Story -* [DevSecOps](/stories/devsecops) +* [Dev Sec Ops](/stories/dev_sec_ops) #### How To Implement -To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. +To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. #### Required field * _time @@ -83,7 +93,6 @@ To successfully implement this search, you need to be ingesting logs related to network admin or normal user may share files to customer and external team. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ network admin or normal user may share files to customer and external team. + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md index 88c90cb58b..bf058a9361 100644 --- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md +++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md @@ -1,6 +1,6 @@ --- title: "GSuite Email Suspicious Attachment" -excerpt: "Spearphishing Attachment" +excerpt: "Spearphishing Attachment, Phishing" categories: - Cloud last_modified_at: 2021-08-16 @@ -11,6 +11,9 @@ tags: - T1566.001 - Spearphishing Attachment - Initial Access + - T1566 + - Phishing + - Initial Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect a suspicious attachment file extension in Gsuite email #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + + + + #### Search ``` @@ -54,7 +64,7 @@ This search is to detect a suspicious attachment file extension in Gsuite email ``` #### Associated Analytic Story -* [DevSecOps](/stories/devsecops) +* [Dev Sec Ops](/stories/dev_sec_ops) #### How To Implement @@ -80,7 +90,6 @@ To successfully implement this search, you need to be ingesting logs related to network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +98,7 @@ network admin and normal user may send this file attachment as part of their day + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md index cb7e2ec3bb..4e8803c2a7 100644 --- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md +++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md @@ -1,6 +1,6 @@ --- title: "7zip CommandLine To SMB Share Path" -excerpt: "Archive via Utility" +excerpt: "Archive via Utility, Archive Collected Data" categories: - Endpoint last_modified_at: 2021-08-17 @@ -11,6 +11,9 @@ tags: - T1560.001 - Archive via Utility - Collection + - T1560 + - Archive Collected Data + - Collection - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect a suspicious 7z process with commandline pointing to SM #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1560.001](https://attack.mitre.org/techniques/T1560/001/) | Archive via Utility | Collection | + +| [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection | + + + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ unknown + #### Reference * [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html) diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md index 6cf02a210a..d00ceb0abe 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md @@ -1,6 +1,6 @@ --- title: "AWS ECR Container Scanning Findings High" -excerpt: "Malicious Image" +excerpt: "Malicious Image, User Execution" categories: - Cloud last_modified_at: 2021-08-17 @@ -11,6 +11,9 @@ tags: - T1204.003 - Malicious Image - Execution + - T1204 + - User Execution + - Execution - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + + + + #### Search ``` @@ -86,7 +96,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +104,7 @@ unknown + #### Reference * [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md index bbc82e334f..e886bdc87d 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md @@ -1,6 +1,6 @@ --- title: "AWS ECR Container Scanning Findings Low Informational Unknown" -excerpt: "Malicious Image" +excerpt: "Malicious Image, User Execution" categories: - Cloud last_modified_at: 2021-08-17 @@ -11,6 +11,9 @@ tags: - T1204.003 - Malicious Image - Execution + - T1204 + - User Execution + - Execution - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + + + + #### Search ``` @@ -86,7 +96,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +104,7 @@ unknown + #### Reference * [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md index db241c2718..fd615fa432 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md @@ -1,6 +1,6 @@ --- title: "AWS ECR Container Scanning Findings Medium" -excerpt: "Malicious Image" +excerpt: "Malicious Image, User Execution" categories: - Cloud last_modified_at: 2021-08-17 @@ -11,6 +11,9 @@ tags: - T1204.003 - Malicious Image - Execution + - T1204 + - User Execution + - Execution - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + + + + #### Search ``` @@ -86,7 +96,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +104,7 @@ unknown + #### Reference * [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md index c4d335254f..ae36a4c6a4 100644 --- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md +++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md @@ -1,6 +1,6 @@ --- title: "Gsuite Outbound Email With Attachment To External Domain" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" +excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Exfiltration Over Alternative Protocol" categories: - Cloud last_modified_at: 2021-08-17 @@ -11,6 +11,9 @@ tags: - T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol - Exfiltration + - T1048 + - Exfiltration Over Alternative Protocol + - Exfiltration - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect a suspicious outbound e-mail from internal email to ext #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | + +| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | + + + + + #### Search ``` @@ -59,7 +69,7 @@ This search is to detect a suspicious outbound e-mail from internal email to ext ``` #### Associated Analytic Story -* [DevSecOps](/stories/devsecops) +* [Dev Sec Ops](/stories/dev_sec_ops) #### How To Implement @@ -77,7 +87,6 @@ To successfully implement this search, you need to be ingesting logs related to network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ network admin and normal user may send this file attachment as part of their day + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index 2a224f4adf..9c0744b98f 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -1,6 +1,6 @@ --- title: "Esentutl SAM Copy" -excerpt: "Security Account Manager" +excerpt: "Security Account Manager, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-08-18 @@ -11,6 +11,9 @@ tags: - T1003.002 - Security Account Manager - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +41,17 @@ The following analytic identifies the process - `esentutl.exe` - being used to c #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -84,7 +94,6 @@ To successfully implement this search you need to be ingesting information on pr False positives should be limited. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ False positives should be limited. Filter as needed. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md](https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md) diff --git a/docs/_posts/2021-08-18-powershell_4104_hunting.md b/docs/_posts/2021-08-18-powershell_4104_hunting.md index 01acaecee0..4a595d4c1f 100644 --- a/docs/_posts/2021-08-18-powershell_4104_hunting.md +++ b/docs/_posts/2021-08-18-powershell_4104_hunting.md @@ -1,6 +1,6 @@ --- title: "PowerShell 4104 Hunting" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2021-08-18 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -36,10 +39,17 @@ The following Hunting analytic assists with identifying suspicious PowerShell ex #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -244,7 +254,6 @@ The following Hunting analytic requires PowerShell operational logs to be import Limited false positives. May filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -253,6 +262,7 @@ Limited false positives. May filter as needed. + #### Reference * [https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md](https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md) diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md index 25df3e4ad1..1d47e4f495 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md @@ -1,6 +1,6 @@ --- title: "AWS ECR Container Upload Outside Business Hours" -excerpt: "Malicious Image" +excerpt: "Malicious Image, User Execution" categories: - Cloud last_modified_at: 2021-08-19 @@ -11,6 +11,9 @@ tags: - T1204.003 - Malicious Image - Execution + - T1204 + - User Execution + - Execution - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + + + + #### Search ``` @@ -82,7 +92,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit When your development is spreaded in different time zones, applying this rule can be difficult. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ When your development is spreaded in different time zones, applying this rule ca + #### Reference * [https://attack.mitre.org/techniques/T1204/003/](https://attack.mitre.org/techniques/T1204/003/) diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md index 85015fc4b3..b4593205a8 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md @@ -1,6 +1,6 @@ --- title: "AWS ECR Container Upload Unknown User" -excerpt: "Malicious Image" +excerpt: "Malicious Image, User Execution" categories: - Cloud last_modified_at: 2021-08-19 @@ -11,6 +11,9 @@ tags: - T1204.003 - Malicious Image - Execution + - T1204 + - User Execution + - Execution - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + + + + #### Search ``` @@ -82,7 +92,6 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ unknown + #### Reference * [https://attack.mitre.org/techniques/T1204/003/](https://attack.mitre.org/techniques/T1204/003/) diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md index 59fe798d36..6266eb4fc1 100644 --- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md +++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md @@ -1,6 +1,6 @@ --- title: "Gsuite Email Suspicious Subject With Attachment" -excerpt: "Spearphishing Attachment" +excerpt: "Spearphishing Attachment, Phishing" categories: - Cloud last_modified_at: 2021-08-19 @@ -11,6 +11,9 @@ tags: - T1566.001 - Spearphishing Attachment - Initial Access + - T1566 + - Phishing + - Initial Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect a gsuite email contains suspicious subject having known #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + + + + #### Search ``` @@ -57,7 +67,7 @@ This search is to detect a gsuite email contains suspicious subject having known ``` #### Associated Analytic Story -* [DevSecOps](/stories/devsecops) +* [Dev Sec Ops](/stories/dev_sec_ops) #### How To Implement @@ -77,6 +87,7 @@ normal user or normal transaction may contain the subject and file type attachme + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index 1c199a8a74..3438a0b3d2 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -74,6 +74,7 @@ Some networks may use kerberized FTP or telnet servers, however, this is rare. + #### Reference * [https://www.rackaid.com/blog/secure-your-email-and-file-transfers/](https://www.rackaid.com/blog/secure-your-email-and-file-transfers/) diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md index 9a3008715c..6723ab8912 100644 --- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md +++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md @@ -37,11 +37,14 @@ This search is to detect a pushed or commit to master or main branch. This is to #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1199](https://attack.mitre.org/techniques/T1199/) | Trusted Relationship | Initial Access | + + #### Search ``` @@ -56,7 +59,7 @@ This search is to detect a pushed or commit to master or main branch. This is to ``` #### Associated Analytic Story -* [DevSecOps](/stories/devsecops) +* [Dev Sec Ops](/stories/dev_sec_ops) #### How To Implement @@ -74,7 +77,6 @@ To successfully implement this search, you need to be ingesting logs related to admin can do changes directly to master branch - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ admin can do changes directly to master branch + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md index d49b7629b1..58cac9b04a 100644 --- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md +++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md @@ -37,11 +37,14 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1212](https://attack.mitre.org/techniques/T1212/) | Exploitation for Credential Access | Credential Access | + + #### Search ``` @@ -78,7 +81,6 @@ You must ingest Kubernetes logs through Splunk Connect for Kubernetes. unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ unknown + #### Reference * [https://github.com/splunk/splunk-connect-for-kubernetes](https://github.com/splunk/splunk-connect-for-kubernetes) diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md index eed0d2fc11..a9556eea49 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md @@ -1,6 +1,6 @@ --- title: "GetLocalUser with PowerShell" -excerpt: "Local Account" +excerpt: "Account Discovery, Local Account" categories: - Endpoint last_modified_at: 2021-08-23 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1087 + - Account Discovery + - Discovery - T1087.001 - Local Account - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | + + + #### Search ``` @@ -71,7 +81,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -80,6 +89,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md index 0f2ff9d6b9..5c04ef6247 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md @@ -1,6 +1,6 @@ --- title: "GetLocalUser with PowerShell Script Block" -excerpt: "Local Account" +excerpt: "Account Discovery, Local Account" categories: - Endpoint last_modified_at: 2021-08-23 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1087 + - Account Discovery + - Discovery - T1087.001 - Local Account - Discovery @@ -37,10 +40,17 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | + + + #### Search ``` @@ -69,7 +79,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -78,6 +87,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md index 9e78db3a6a..e4a0f79f8c 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md @@ -1,6 +1,6 @@ --- title: "GetWmiObject User Account with PowerShell" -excerpt: "Local Account" +excerpt: "Account Discovery, Local Account" categories: - Endpoint last_modified_at: 2021-08-23 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1087 + - Account Discovery + - Discovery - T1087.001 - Local Account - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | + + + #### Search ``` @@ -71,7 +81,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -80,6 +89,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md index 915829d14d..ba50bb8b60 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md @@ -1,6 +1,6 @@ --- title: "GetWmiObject User Account with PowerShell Script Block" -excerpt: "Local Account" +excerpt: "Account Discovery, Local Account" categories: - Endpoint last_modified_at: 2021-08-23 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1087 + - Account Discovery + - Discovery - T1087.001 - Local Account - Discovery @@ -37,10 +40,17 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | + + + #### Search ``` @@ -69,7 +79,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -78,6 +87,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md index 6d4bd01d15..20078adf3d 100644 --- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md +++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md @@ -1,6 +1,6 @@ --- title: "Gsuite Email With Known Abuse Web Service Link" -excerpt: "Spearphishing Attachment" +excerpt: "Spearphishing Attachment, Phishing" categories: - Cloud last_modified_at: 2021-08-23 @@ -11,6 +11,9 @@ tags: - T1566.001 - Spearphishing Attachment - Initial Access + - T1566 + - Phishing + - Initial Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytics is to detect a gmail containing a link that are known to be abuse #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + + + + #### Search ``` @@ -57,7 +67,7 @@ This analytics is to detect a gmail containing a link that are known to be abuse ``` #### Associated Analytic Story -* [DevSecOps](/stories/devsecops) +* [Dev Sec Ops](/stories/dev_sec_ops) #### How To Implement @@ -77,6 +87,7 @@ normal email contains this link that are known application within the organizati + #### Reference * [https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/](https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/) diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md index 4098eb80bb..7c99ae6328 100644 --- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md +++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md @@ -1,6 +1,6 @@ --- title: "Gsuite Suspicious Shared File Name" -excerpt: "Spearphishing Attachment" +excerpt: "Spearphishing Attachment, Phishing" categories: - Cloud last_modified_at: 2021-08-23 @@ -11,6 +11,9 @@ tags: - T1566.001 - Spearphishing Attachment - Initial Access + - T1566 + - Phishing + - Initial Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search is to detect a shared file in google drive with suspicious file name #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + + + + #### Search ``` @@ -58,11 +68,11 @@ This search is to detect a shared file in google drive with suspicious file name ``` #### Associated Analytic Story -* [DevSecOps](/stories/devsecops) +* [Dev Sec Ops](/stories/dev_sec_ops) #### How To Implement -To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. +To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. #### Required field * _time @@ -83,7 +93,6 @@ To successfully implement this search, you need to be ingesting logs related to normal user or normal transaction may contain the subject and file type attachment that this detection try to search - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ normal user or normal transaction may contain the subject and file type attachme + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md index 375fa22c8f..3d3e16bff6 100644 --- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md +++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md @@ -37,11 +37,14 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1212](https://attack.mitre.org/techniques/T1212/) | Exploitation for Credential Access | Credential Access | + + #### Search ``` @@ -78,7 +81,6 @@ You must ingest Kubernetes logs through Splunk Connect for Kubernetes. unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ unknown + #### Reference * [https://github.com/splunk/splunk-connect-for-kubernetes](https://github.com/splunk/splunk-connect-for-kubernetes) diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md index 113597705a..4a216e8864 100644 --- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md +++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md @@ -1,6 +1,6 @@ --- title: "AdsiSearcher Account Discovery" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-08-24 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -74,7 +84,6 @@ The following Hunting analytic requires PowerShell operational logs to be import Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +92,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1087/002/](https://attack.mitre.org/techniques/T1087/002/) diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md index 90275f24bf..4ac5335948 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md @@ -1,6 +1,6 @@ --- title: "Domain Account Discovery with Dsquery" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-08-24 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm](https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm) diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index 65583237ad..c99de38d92 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -1,6 +1,6 @@ --- title: "Domain Account Discovery With Net App" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-08-24 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance](https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance) diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md index b27f2d5725..ceec1b034e 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md @@ -1,6 +1,6 @@ --- title: "Domain Account Discovery with Wmic" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-08-24 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1087/002/](https://attack.mitre.org/techniques/T1087/002/) diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md index cf98761d68..0d34068afe 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md @@ -37,11 +37,14 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ Limited false positives as this requires an active Administrator or adversary to + #### Reference * [http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/](http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/) diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md index 50deca2a20..fd365dc0df 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md @@ -38,11 +38,14 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + #### Search ``` @@ -78,7 +81,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri It is possible certain system management frameworks utilize this command to gather trust information. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ It is possible certain system management frameworks utilize this command to gath + #### Reference * [http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/](http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/) diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md index 599f00a72b..a76e462a76 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md @@ -1,6 +1,6 @@ --- title: "Get ADUser with PowerShell" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-08-24 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://www.blackhillsinfosec.com/red-blue-purple/](https://www.blackhillsinfosec.com/red-blue-purple/) diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md index c189cc6d04..49234b8a5b 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md @@ -1,6 +1,6 @@ --- title: "Get ADUser with PowerShell Script Block" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-08-24 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -74,7 +84,6 @@ The following Hunting analytic requires PowerShell operational logs to be import Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +92,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://www.blackhillsinfosec.com/red-blue-purple/](https://www.blackhillsinfosec.com/red-blue-purple/) diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md index 9e90b67d91..3bbf5616e1 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md @@ -1,6 +1,6 @@ --- title: "Get DomainUser with PowerShell" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-08-24 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/) diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md index a0f8b7e199..9d5376d111 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md @@ -1,6 +1,6 @@ --- title: "Get DomainUser with PowerShell Script Block" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-08-24 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -74,7 +84,6 @@ The following Hunting analytic requires PowerShell operational logs to be import Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +92,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/) diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md index f16c96080d..7bddb6c1f5 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md @@ -1,6 +1,6 @@ --- title: "GetWmiObject DS User with PowerShell" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-08-24 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm](https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm) diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md index bcd37bd048..0d0eb83e8f 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md @@ -1,6 +1,6 @@ --- title: "GetWmiObject DS User with PowerShell Script Block" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-08-24 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -74,7 +84,6 @@ he following Hunting analytic requires PowerShell operational logs to be importe Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +92,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://www.blackhillsinfosec.com/red-blue-purple/](https://www.blackhillsinfosec.com/red-blue-purple/) diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md index fab34c481e..a78825c9b4 100644 --- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md +++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md @@ -37,11 +37,14 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ You must ingest Kubernetes logs through Splunk Connect for Kubernetes. unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ unknown + #### Reference * [https://github.com/splunk/splunk-connect-for-kubernetes](https://github.com/splunk/splunk-connect-for-kubernetes) diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md index 60269c375c..c7e84c3c82 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md @@ -1,6 +1,6 @@ --- title: "Domain Group Discovery with Adsisearcher" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-25 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -73,7 +83,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use Adsisearcher for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -82,6 +91,7 @@ Administrators or power users may use Adsisearcher for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md index 35760654b0..fdd3062f75 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md @@ -1,6 +1,6 @@ --- title: "Domain Group Discovery With Net" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-25 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md index 02d98a6413..3b1b2a43c8 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md @@ -1,6 +1,6 @@ --- title: "Domain Group Discovery With Wmic" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-25 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md index 8895a3addb..eb88b161df 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md @@ -1,6 +1,6 @@ --- title: "Elevated Group Discovery With Net" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-25 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md index c924ff245e..8c1d968d90 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md @@ -1,6 +1,6 @@ --- title: "Elevated Group Discovery with PowerView" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-25 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -73,7 +83,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerView for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -82,6 +91,7 @@ Administrators or power users may use this PowerView for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md index 89d13a53fa..2953408c1d 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md @@ -1,6 +1,6 @@ --- title: "Elevated Group Discovery With Wmic" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-25 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md index 94ea59455b..af8324b559 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md @@ -1,6 +1,6 @@ --- title: "GetAdGroup with PowerShell" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-25 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md index c6028b8c4d..d6ae49ae13 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md @@ -1,6 +1,6 @@ --- title: "GetAdGroup with PowerShell Script Block" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-25 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -73,7 +83,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -82,6 +91,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md index 0a7469125f..d37f90d3cf 100644 --- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md @@ -1,6 +1,6 @@ --- title: "GetDomainGroup with PowerShell" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-25 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md index 5afdf70ee1..56c9217909 100644 --- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md +++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `powershell.exe` with command-line util #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/) diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md index 26ad5c0f55..86f0716598 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md @@ -1,6 +1,6 @@ --- title: "GetWmiObject Ds Group with PowerShell" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-25 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md index 70648bb977..2bc811992a 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md @@ -1,6 +1,6 @@ --- title: "GetWmiObject Ds Group with PowerShell Script Block" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-25 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -73,7 +83,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -82,6 +91,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md index 58ffb21214..18e513ae6d 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | + + #### Search ``` @@ -80,7 +83,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md index f63e406433..8022b06cf0 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md @@ -37,11 +37,14 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | + + #### Search ``` @@ -75,7 +78,6 @@ The following Hunting analytic requires PowerShell operational logs to be import Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +86,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md index f1988a561f..90705f40b5 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | + + #### Search ``` @@ -80,7 +83,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md index 40ca4033da..9761feb7c0 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md @@ -37,11 +37,14 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | + + #### Search ``` @@ -75,7 +78,6 @@ The following Hunting analytic requires PowerShell operational logs to be import Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +86,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md index 5e130c9dad..673befa665 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | + + #### Search ``` @@ -80,7 +83,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md index db4105b581..345b7209ef 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md @@ -37,11 +37,14 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | + + #### Search ``` @@ -75,7 +78,6 @@ The following Hunting analytic requires PowerShell operational logs to be import Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +86,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md index ec48c51c03..987de0cddd 100644 --- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md @@ -1,6 +1,6 @@ --- title: "GetDomainGroup with PowerShell Script Block" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-08-26 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -73,7 +83,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerView functions for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -82,6 +91,7 @@ Administrators or power users may use this PowerView functions for troubleshooti + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md index b424925778..9f60318d90 100644 --- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md +++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | + + #### Search ``` @@ -80,7 +83,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +91,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md index da00993432..38f8a5c496 100644 --- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md +++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md @@ -1,6 +1,6 @@ --- title: "Process Creating LNK file in Suspicious Location" -excerpt: "Spearphishing Link" +excerpt: "Phishing, Spearphishing Link" categories: - Endpoint last_modified_at: 2021-08-26 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.002 - Spearphishing Link - Initial Access @@ -38,10 +41,17 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.002](https://attack.mitre.org/techniques/T1566/002/) | Spearphishing Link | Initial Access | + + + #### Search ``` @@ -87,7 +97,6 @@ You must be ingesting data that records filesystem and process activity from you This detection should yield little or no false positive results. It is uncommon for LNK files to be executed from temporary or user directories. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -96,6 +105,7 @@ This detection should yield little or no false positive results. It is uncommon + #### Reference * [https://attack.mitre.org/techniques/T1566/001/](https://attack.mitre.org/techniques/T1566/001/) diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index f0fbdfa794..473e796538 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -42,11 +42,14 @@ Review the source attempting to perform this activity against your environment. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | + + #### Search ``` @@ -81,7 +84,6 @@ The following analytic requires on-premise Exchange to be logging to Splunk usin Limited false positives, however, tune as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +92,7 @@ Limited false positives, however, tune as needed. + #### Reference * [https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF](https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF) diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index ff3d0d1d43..e94ae9722c 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -1,6 +1,6 @@ --- title: "Exchange PowerShell Module Usage" -excerpt: "PowerShell" +excerpt: "Command and Scripting Interpreter, PowerShell" categories: - Endpoint last_modified_at: 2021-08-27 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.001 - PowerShell - Execution @@ -42,10 +45,17 @@ Module - New-managementroleassignment can assign a management role to a manageme #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps](https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps) diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md index 882b31a46c..4e1d0662a5 100644 --- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md +++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `nltest.exe` with command-line argument #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md index 487e64128b..60291b2db6 100644 --- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md +++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md index 91ba8ed436..4ef87f68cd 100644 --- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md +++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-36942 - Exploitation - Lateral Movement --- @@ -40,11 +41,14 @@ During triage, review parallel security events to identify further suspicious ac #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1187](https://attack.mitre.org/techniques/T1187/) | Forced Authentication | Credential Access | + + #### Search ``` @@ -81,7 +85,6 @@ Windows Event Code 5145 is required to utilize this analytic and it may not be e False positives have been limited when the Anonymous Logon is used for Account Name. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +93,14 @@ False positives have been limited when the Anonymous Logon is used for Account N +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-36942](https://nvd.nist.gov/vuln/detail/CVE-2021-36942) | Windows LSA Spoofing Vulnerability | 5.0 | + + + #### Reference * [https://attack.mitre.org/techniques/T1187/](https://attack.mitre.org/techniques/T1187/) diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md index 7d5dbd4086..bf1eff8a6d 100644 --- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md +++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md @@ -14,6 +14,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-36942 - Exploitation - Lateral Movement --- @@ -37,11 +38,14 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + #### Search ``` @@ -77,7 +81,6 @@ The following analytic requires Event Code 4768. Ensure that it is logging no Do False positives are possible if the environment is using certificates for authentication. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +89,14 @@ False positives are possible if the environment is using certificates for authen +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-36942](https://nvd.nist.gov/vuln/detail/CVE-2021-36942) | Windows LSA Spoofing Vulnerability | 5.0 | + + + #### Reference * [https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4768](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4768) diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md index 140b140c82..8d166c8a3c 100644 --- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md index d41dd8cf16..0c4f631a29 100644 --- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md +++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md @@ -37,11 +37,14 @@ This search looks for disable security step in CircleCI pipeline. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence | + + #### Search ``` @@ -82,7 +85,6 @@ You must index CircleCI logs. unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ unknown + #### Reference diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md index b1a79a87eb..dfaffe5267 100644 --- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md index bc51a3bec2..fd95fc6938 100644 --- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md +++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md @@ -1,6 +1,6 @@ --- title: "Domain Group Discovery With Dsquery" -excerpt: "Domain Groups" +excerpt: "Permission Groups Discovery, Domain Groups" categories: - Endpoint last_modified_at: 2021-09-01 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.002 - Domain Groups - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md index 2632204771..b0f0683b18 100644 --- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md @@ -37,11 +37,14 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -74,7 +77,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md index 9e3a05534f..9ad7d62b13 100644 --- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md @@ -37,11 +37,14 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -74,7 +77,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md index 95884508b8..a2bdc354e9 100644 --- a/docs/_posts/2021-09-01-github_commit_in_develop.md +++ b/docs/_posts/2021-09-01-github_commit_in_develop.md @@ -37,11 +37,14 @@ This search is to detect a pushed or commit to develop branch. This is to avoid #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1199](https://attack.mitre.org/techniques/T1199/) | Trusted Relationship | Initial Access | + + #### Search ``` @@ -54,7 +57,7 @@ This search is to detect a pushed or commit to develop branch. This is to avoid ``` #### Associated Analytic Story -* [DevSecOps](/stories/devsecops) +* [Dev Sec Ops](/stories/dev_sec_ops) #### How To Implement @@ -72,7 +75,6 @@ To successfully implement this search, you need to be ingesting logs related to admin can do changes directly to develop branch - #### RBA | Risk Score | Impact | Confidence | Message | @@ -81,6 +83,7 @@ admin can do changes directly to develop branch + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md index 3af3e9c1b1..1470737198 100644 --- a/docs/_posts/2021-09-01-github_dependabot_alert.md +++ b/docs/_posts/2021-09-01-github_dependabot_alert.md @@ -1,6 +1,6 @@ --- title: "GitHub Dependabot Alert" -excerpt: "Compromise Software Dependencies and Development Tools" +excerpt: "Compromise Software Dependencies and Development Tools, Supply Chain Compromise" categories: - Cloud last_modified_at: 2021-09-01 @@ -11,6 +11,9 @@ tags: - T1195.001 - Compromise Software Dependencies and Development Tools - Initial Access + - T1195 + - Supply Chain Compromise + - Initial Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search looks for Dependabot Alerts in Github logs. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1195.001](https://attack.mitre.org/techniques/T1195/001/) | Compromise Software Dependencies and Development Tools | Initial Access | + +| [T1195](https://attack.mitre.org/techniques/T1195/) | Supply Chain Compromise | Initial Access | + + + + + #### Search ``` @@ -83,7 +93,6 @@ You must index GitHub logs. You can follow the url in reference to onboard GitHu unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ unknown + #### Reference * [https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html](https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html) diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 6840e35bc1..ab3824347a 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -1,6 +1,6 @@ --- title: "GitHub Pull Request from Unknown User" -excerpt: "Compromise Software Dependencies and Development Tools" +excerpt: "Compromise Software Dependencies and Development Tools, Supply Chain Compromise" categories: - Cloud last_modified_at: 2021-09-01 @@ -11,6 +11,9 @@ tags: - T1195.001 - Compromise Software Dependencies and Development Tools - Initial Access + - T1195 + - Supply Chain Compromise + - Initial Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search looks for Pull Request from unknown user. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1195.001](https://attack.mitre.org/techniques/T1195/001/) | Compromise Software Dependencies and Development Tools | Initial Access | + +| [T1195](https://attack.mitre.org/techniques/T1195/) | Supply Chain Compromise | Initial Access | + + + + + #### Search ``` @@ -84,7 +94,6 @@ You must index GitHub logs. You can follow the url in reference to onboard GitHu unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ unknown + #### Reference * [https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html](https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html) diff --git a/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_at_the_destination_device.md b/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_at_the_destination_device.md index c7bc0cda31..9a0748ddeb 100644 --- a/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_at_the_destination_device.md +++ b/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_at_the_destination_device.md @@ -1,6 +1,6 @@ --- title: "Potential Pass the Token or Hash Observed at the Destination Device" -excerpt: "Pass the Hash" +excerpt: "Use Alternate Authentication Material, Pass the Hash" categories: - Endpoint last_modified_at: 2021-09-01 @@ -8,6 +8,10 @@ toc: true toc_label: "" tags: - TTP + - T1550 + - Use Alternate Authentication Material + - Defense Evasion + - Lateral Movement - T1550.002 - Pass the Hash - Defense Evasion @@ -35,10 +39,17 @@ This detection identifies potential Pass the Token or Pass the Hash credential e #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1550](https://attack.mitre.org/techniques/T1550/) | Use Alternate Authentication Material | Defense Evasion, Lateral Movement | + + | [T1550.002](https://attack.mitre.org/techniques/T1550/002/) | Pass the Hash | Defense Evasion, Lateral Movement | + + + #### Search ``` @@ -83,7 +94,6 @@ You must be ingesting Windows Security logs from endpoint devices, i.e., destina Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +102,7 @@ Environments in which NTLM is used extremely rarely and for benign purposes (suc + #### Reference * [https://attack.mitre.org/techniques/T1550/002/](https://attack.mitre.org/techniques/T1550/002/) diff --git a/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md b/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md index ebf9b5c469..cf43b3e9da 100644 --- a/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md +++ b/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md @@ -1,6 +1,6 @@ --- title: "Potential Pass the Token or Hash Observed by an Event Collecting Device" -excerpt: "Pass the Hash" +excerpt: "Use Alternate Authentication Material, Pass the Hash" categories: - Endpoint last_modified_at: 2021-09-01 @@ -8,6 +8,10 @@ toc: true toc_label: "" tags: - TTP + - T1550 + - Use Alternate Authentication Material + - Defense Evasion + - Lateral Movement - T1550.002 - Pass the Hash - Defense Evasion @@ -35,10 +39,17 @@ This detection identifies potential Pass the Token or Pass the Hash credential e #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1550](https://attack.mitre.org/techniques/T1550/) | Use Alternate Authentication Material | Defense Evasion, Lateral Movement | + + | [T1550.002](https://attack.mitre.org/techniques/T1550/002/) | Pass the Hash | Defense Evasion, Lateral Movement | + + + #### Search ``` @@ -83,7 +94,6 @@ You must be ingesting Windows Security logs from devices of interest - at least Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares). - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +102,7 @@ Environments in which NTLM is used extremely rarely and for benign purposes (suc + #### Reference * [https://attack.mitre.org/techniques/T1550/002/](https://attack.mitre.org/techniques/T1550/002/) diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md index a3b088f082..3afcd62983 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md @@ -37,11 +37,14 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -74,7 +77,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use Adsisearcher for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ Administrators or power users may use Adsisearcher for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md index 7fd3d7d281..f6044202b2 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md index 6e8307bed3..aedf125379 100644 --- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md +++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md @@ -37,11 +37,14 @@ This search looks for disable security job in CircleCI pipeline. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence | + + #### Search ``` @@ -78,7 +81,6 @@ You must index CircleCI logs. unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ unknown + #### Reference diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md index 60f7e38e77..57dcb0d70b 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md @@ -37,11 +37,14 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ Limited false positives as this requires an active Administrator or adversary to + #### Reference * [https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/](https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/) diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md index 595c5cce7a..a1d8f0f075 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md @@ -39,11 +39,14 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri UPDATE_KNOWN_FALSE_POSITIVES - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ UPDATE_KNOWN_FALSE_POSITIVES + #### Reference * [https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/](https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/) diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md index 09195b880e..1e184c509c 100644 --- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md @@ -37,11 +37,14 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -74,7 +77,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use PowerView for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ Administrators or power users may use PowerView for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md index 9430c2961b..be49479a4a 100644 --- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md @@ -37,11 +37,14 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -74,7 +77,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-06-add_defaultuser_and_password_in_registry.md b/docs/_posts/2021-09-06-add_defaultuser_and_password_in_registry.md index da3c1296a9..3da5c177e4 100644 --- a/docs/_posts/2021-09-06-add_defaultuser_and_password_in_registry.md +++ b/docs/_posts/2021-09-06-add_defaultuser_and_password_in_registry.md @@ -1,6 +1,6 @@ --- title: "Add DefaultUser And Password In Registry" -excerpt: "Credentials in Registry" +excerpt: "Credentials in Registry, Unsecured Credentials" categories: - Endpoint last_modified_at: 2021-09-06 @@ -11,6 +11,9 @@ tags: - T1552.002 - Credentials in Registry - Credential Access + - T1552 + - Unsecured Credentials + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ this search is to detect a suspicious registry modification to implement auto ad #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1552.002](https://attack.mitre.org/techniques/T1552/002/) | Credentials in Registry | Credential Access | + +| [T1552](https://attack.mitre.org/techniques/T1552/) | Unsecured Credentials | Credential Access | + + + + + #### Search ``` @@ -75,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ unknown + #### Reference * [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/) diff --git a/docs/_posts/2021-09-06-auto_admin_logon_registry_entry.md b/docs/_posts/2021-09-06-auto_admin_logon_registry_entry.md index 7d5ced6fe8..af62c19629 100644 --- a/docs/_posts/2021-09-06-auto_admin_logon_registry_entry.md +++ b/docs/_posts/2021-09-06-auto_admin_logon_registry_entry.md @@ -1,6 +1,6 @@ --- title: "Auto Admin Logon Registry Entry" -excerpt: "Credentials in Registry" +excerpt: "Credentials in Registry, Unsecured Credentials" categories: - Endpoint last_modified_at: 2021-09-06 @@ -11,6 +11,9 @@ tags: - T1552.002 - Credentials in Registry - Credential Access + - T1552 + - Unsecured Credentials + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ this search is to detect a suspicious registry modification to implement auto ad #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1552.002](https://attack.mitre.org/techniques/T1552/002/) | Credentials in Registry | Credential Access | + +| [T1552](https://attack.mitre.org/techniques/T1552/) | Unsecured Credentials | Credential Access | + + + + + #### Search ``` @@ -75,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ unknown + #### Reference * [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/) diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md index 19ccb997ac..3ea46e0234 100644 --- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md +++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md @@ -37,11 +37,14 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | + + #### Search ``` @@ -78,7 +81,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ unknown + #### Reference * [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/) diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md index 552d28981d..9736c68482 100644 --- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md +++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md @@ -37,11 +37,14 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | + + #### Search ``` @@ -78,7 +81,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +89,7 @@ unknown + #### Reference * [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/) diff --git a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md index 9e592fd06e..fd538cbd32 100644 --- a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md @@ -1,6 +1,6 @@ --- title: "Correlation by Repository and Risk" -excerpt: "Malicious Image" +excerpt: "Malicious Image, User Execution" categories: - Cloud last_modified_at: 2021-09-06 @@ -11,6 +11,9 @@ tags: - T1204.003 - Malicious Image - Execution + - T1204 + - User Execution + - Execution - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search correlations detections by repository and risk_score #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + + + + #### Search ``` @@ -71,7 +81,6 @@ For Dev Sec Ops POC unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -80,6 +89,7 @@ unknown + #### Reference diff --git a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md index 76320b98ef..1a6faee558 100644 --- a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md @@ -1,6 +1,6 @@ --- title: "Correlation by User and Risk" -excerpt: "Malicious Image" +excerpt: "Malicious Image, User Execution" categories: - Cloud last_modified_at: 2021-09-06 @@ -11,6 +11,9 @@ tags: - T1204.003 - Malicious Image - Execution + - T1204 + - User Execution + - Execution - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search correlations detections by user and risk_score #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + + + + #### Search ``` @@ -71,7 +81,6 @@ For Dev Sec Ops POC unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -80,6 +89,7 @@ unknown + #### Reference diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md index fdd748e472..2199e6d059 100644 --- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md index 93fc74d6de..32eefd3a36 100644 --- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use PowerView for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use PowerView for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md index 88acee3c86..afd6d91110 100644 --- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use PowerView for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use PowerView for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md index fab867a91b..4c044be89d 100644 --- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md +++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-07-registry_keys_used_for_persistence.md b/docs/_posts/2021-09-07-registry_keys_used_for_persistence.md index 69bd0e80b5..c552f86aba 100644 --- a/docs/_posts/2021-09-07-registry_keys_used_for_persistence.md +++ b/docs/_posts/2021-09-07-registry_keys_used_for_persistence.md @@ -1,6 +1,6 @@ --- title: "Registry Keys Used For Persistence" -excerpt: "Registry Run Keys / Startup Folder" +excerpt: "Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution" categories: - Endpoint last_modified_at: 2021-09-07 @@ -12,6 +12,10 @@ tags: - Registry Run Keys / Startup Folder - Persistence - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,15 +42,22 @@ The search looks for modifications to registry keys that can be used to launch a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1547.001](https://attack.mitre.org/techniques/T1547/001/) | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation | + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + #### Search ``` -| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` @@ -84,7 +95,6 @@ To successfully implement this search, you must be ingesting data that records r There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +103,7 @@ There are many legitimate applications that must execute on system startup and w + #### Reference diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index 2cc6b26192..40a6364cf5 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -1,6 +1,6 @@ --- title: "SchCache Change By App Connect And Create ADSI Object" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-09-07 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This analytic is to detect an application try to connect and create ADSI Object #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this search, you need to be ingesting logs with the pr normal application like mmc.exe and other ldap query tool may trigger this detections. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ normal application like mmc.exe and other ldap query tool may trigger this detec + #### Reference * [https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac](https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac) diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md index ddc432e85d..4e59dbb88c 100644 --- a/docs/_posts/2021-09-07-system_information_discovery_detection.md +++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md @@ -37,11 +37,14 @@ Detect system information discovery techniques used by attackers to understand c #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators debugging servers - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ Administrators debugging servers + #### Reference * [https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation](https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation) diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md index 8a29f691c0..8fdd2191bc 100644 --- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md +++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md @@ -1,6 +1,6 @@ --- title: "Control Loading from World Writable Directory" -excerpt: "Control Panel" +excerpt: "Signed Binary Proxy Execution, Control Panel" categories: - Endpoint last_modified_at: 2021-09-08 @@ -8,12 +8,16 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.002 - Control Panel - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-40444 - Endpoint - Exploitation --- @@ -37,10 +41,17 @@ The following detection identifies control.exe loading either a .cpl or .inf fro #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.002](https://attack.mitre.org/techniques/T1218/002/) | Control Panel | Defense Evasion | + + + #### Search ``` @@ -81,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives will be present as control.exe does not natively load from writable paths as defined. One may add .cpl or .inf to the command-line if there is any false positives. Tune as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +100,14 @@ Limited false positives will be present as control.exe does not natively load fr +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | + + + #### Reference * [https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html](https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html) diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md index 0de244fcba..ab7403bf2f 100644 --- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md +++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md @@ -1,6 +1,6 @@ --- title: "Create local admin accounts using net exe" -excerpt: "Local Account" +excerpt: "Local Account, Create Account" categories: - Endpoint last_modified_at: 2021-09-08 @@ -11,6 +11,9 @@ tags: - T1136.001 - Local Account - Persistence + - T1136 + - Create Account + - Persistence - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search looks for the creation of local administrator accounts using net.exe #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1136.001](https://attack.mitre.org/techniques/T1136/001/) | Local Account | Persistence | + +| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | + + + + + #### Search ``` @@ -82,7 +92,6 @@ You must be ingesting data that records process activity from your hosts to popu Administrators often leverage net.exe to create admin accounts. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Administrators often leverage net.exe to create admin accounts. + #### Reference diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md index 39c365312a..92d613e8ef 100644 --- a/docs/_posts/2021-09-08-office_spawning_control.md +++ b/docs/_posts/2021-09-08-office_spawning_control.md @@ -1,6 +1,6 @@ --- title: "Office Spawning Control" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-09-08 @@ -8,12 +8,16 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-40444 - Endpoint - Exploitation --- @@ -37,10 +41,17 @@ The following detection identifies control.exe spawning from an office product. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -82,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives should be present. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +101,14 @@ Limited false positives should be present. +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | + + + #### Reference * [https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html](https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html) diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index 290ae60171..61b8e8f940 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -1,6 +1,6 @@ --- title: "Rundll32 Control RunDLL Hunt" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-09-08 @@ -8,12 +8,16 @@ toc: true toc_label: "" tags: - Hunting + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-40444 - Endpoint - Exploitation --- @@ -37,10 +41,17 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -82,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +101,14 @@ This is a hunting detection, meant to provide a understanding of how voluminous +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | + + + #### Reference * [https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html](https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html) diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index 93ab573296..e3cb4cd259 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -1,6 +1,6 @@ --- title: "Rundll32 Control RunDLL World Writable Directory" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-09-08 @@ -8,12 +8,16 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-40444 - Endpoint - Exploitation --- @@ -37,10 +41,17 @@ The following detection identifies rundll32.exe with `control_rundll` within the #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -82,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr This may be tuned, or a new one related, by adding .cpl to command-line. However, it's important to look for both. Tune/filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +101,14 @@ This may be tuned, or a new one related, by adding .cpl to command-line. However +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | + + + #### Reference * [https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html](https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html) diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index 9a73c26ee8..91224ac63c 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -1,6 +1,6 @@ --- title: "Extraction of Registry Hives" -excerpt: "Security Account Manager" +excerpt: "Security Account Manager, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-09-09 @@ -11,6 +11,9 @@ tags: - T1003.002 - Security Account Manager - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr It is possible some agent based products will generate false positives. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ It is possible some agent based products will generate false positives. Filter a + #### Reference * [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html) diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md index 8c389cb550..810c35380d 100644 --- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md +++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md @@ -1,6 +1,6 @@ --- title: "MSHTML Module Load in Office Product" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-09-09 @@ -8,12 +8,16 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-40444 - Endpoint - Exploitation --- @@ -37,10 +41,17 @@ The following detection identifies the module load of mshtml.dll into an Office #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -77,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Limited false positives will be present, however, tune as necessary. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +96,14 @@ Limited false positives will be present, however, tune as necessary. +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | + + + #### Reference * [https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/](https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/) diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md index 32b8ffd48f..51d8fd153c 100644 --- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md +++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md @@ -37,11 +37,14 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | + + #### Search ``` @@ -74,7 +77,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -83,6 +85,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/) diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md index 3893990c8b..7b71908a5f 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/) diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md index 6fc8cb49a3..dcbe64c781 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/) diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md index d94410e5a4..75debd4392 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | + + #### Search ``` @@ -82,7 +85,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +93,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/) diff --git a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md index 29f9d7c643..c71a084ac6 100644 --- a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md +++ b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md @@ -1,6 +1,6 @@ --- title: "Office Product Writing cab or inf" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-09-10 @@ -8,12 +8,16 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-40444 - Endpoint - Exploitation --- @@ -37,10 +41,17 @@ The following analytic identifies behavior related to CVE-2021-40444. Whereas th #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -82,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +101,14 @@ The query is structured in a way that `action` (read, create) is not defined. Re +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | + + + #### Reference * [https://twitter.com/vxunderground/status/1436326057179860992?s=20](https://twitter.com/vxunderground/status/1436326057179860992?s=20) diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md index 8016ffc0b8..2e5240e7ff 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md index 4c1dd58d3a..c25bd5cf0b 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md @@ -37,11 +37,14 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | + + #### Search ``` @@ -76,7 +79,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md index c88df03de3..0ec8369b39 100644 --- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md +++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md @@ -1,6 +1,6 @@ --- title: "Jscript Execution Using Cscript App" -excerpt: "JavaScript" +excerpt: "Command and Scripting Interpreter, JavaScript" categories: - Endpoint last_modified_at: 2021-09-13 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.007 - JavaScript - Execution @@ -37,10 +40,17 @@ This search is to detect a execution of jscript using cscript process. Commonly #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ unknown + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index 517d55c240..b30ddad447 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -1,6 +1,6 @@ --- title: "MS Scripting Process Loading Ldap Module" -excerpt: "JavaScript" +excerpt: "Command and Scripting Interpreter, JavaScript" categories: - Endpoint last_modified_at: 2021-09-13 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Anomaly + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.007 - JavaScript - Execution @@ -37,10 +40,17 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | + + + #### Search ``` @@ -77,7 +87,6 @@ To successfully implement this search, you need to be ingesting logs with the pr automation scripting language may used by network operator to do ldap query. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ automation scripting language may used by network operator to do ldap query. + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index 262b7a86d1..3c77c33b18 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -1,6 +1,6 @@ --- title: "MS Scripting Process Loading WMI Module" -excerpt: "JavaScript" +excerpt: "Command and Scripting Interpreter, JavaScript" categories: - Endpoint last_modified_at: 2021-09-13 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Anomaly + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.007 - JavaScript - Execution @@ -37,10 +40,17 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | + + + #### Search ``` @@ -77,7 +87,6 @@ To successfully implement this search, you need to be ingesting logs with the pr automation scripting language may used by network operator to do ldap query. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +95,7 @@ automation scripting language may used by network operator to do ldap query. + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-13-office_application_drop_executable.md b/docs/_posts/2021-09-13-office_application_drop_executable.md index f956024878..7ed9136387 100644 --- a/docs/_posts/2021-09-13-office_application_drop_executable.md +++ b/docs/_posts/2021-09-13-office_application_drop_executable.md @@ -1,6 +1,6 @@ --- title: "Office Application Drop Executable" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-09-13 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ This search is to detect a suspicious MS office application that drop or create #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -80,7 +90,6 @@ To successfully implement this search, you need to be ingesting logs with the pr office macro for automation may do this behavior - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +98,7 @@ office macro for automation may do this behavior + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md index 8cf8f11548..20322c2d36 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `query.exe` with command-line arguments #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md index 37c9340642..262b1aa245 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md index cc393ff833..cd0d0390dc 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md @@ -37,11 +37,14 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md index ea8b19ff67..b0303f4595 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md @@ -37,11 +37,14 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | + + #### Search ``` @@ -76,7 +79,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri Administrators or power users may use this PowerShell commandlet for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index 2b895861e7..830b54060f 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -37,11 +37,14 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1220](https://attack.mitre.org/techniques/T1220/) | XSL Script Processing | Defense Evasion | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ unknown + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md index e4b477a9ef..6be2120915 100644 --- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md +++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md @@ -1,6 +1,6 @@ --- title: "Cmdline Tool Not Executed In CMD Shell" -excerpt: "JavaScript" +excerpt: "Command and Scripting Interpreter, JavaScript" categories: - Endpoint last_modified_at: 2021-09-14 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1059 + - Command and Scripting Interpreter + - Execution - T1059.007 - JavaScript - Execution @@ -37,10 +40,17 @@ This search is to detect a suspicious parent process execution of commandline to #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | + + + #### Search ``` @@ -78,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the pr network operator or admin may create this type of tool to gather host information - #### RBA | Risk Score | Impact | Confidence | Message | @@ -87,6 +96,7 @@ network operator or admin may create this type of tool to gather host informatio + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md index 38763a11db..6a230c4883 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md @@ -1,6 +1,6 @@ --- title: "Get WMIObject Group Discovery" -excerpt: "Local Groups" +excerpt: "Permission Groups Discovery, Local Groups" categories: - Endpoint last_modified_at: 2021-09-14 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.001 - Local Groups - Discovery @@ -37,10 +40,17 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr False positives may be present. Tune as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ False positives may be present. Tune as needed. + #### Reference * [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/) diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md index 61927dd9fa..3e0d098b1c 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md @@ -1,6 +1,6 @@ --- title: "Get WMIObject Group Discovery with Script Block Logging" -excerpt: "Local Groups" +excerpt: "Permission Groups Discovery, Local Groups" categories: - Endpoint last_modified_at: 2021-09-14 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.001 - Local Groups - Discovery @@ -38,10 +41,17 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | + + + #### Search ``` @@ -75,7 +85,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri False positives may be present. Tune as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -84,6 +93,7 @@ False positives may be present. Tune as needed. + #### Reference * [https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html](https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html) diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md index bd1cf59262..cf3f88a16a 100644 --- a/docs/_posts/2021-09-14-net_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md @@ -1,6 +1,6 @@ --- title: "Net Localgroup Discovery" -excerpt: "Local Groups" +excerpt: "Permission Groups Discovery, Local Groups" categories: - Endpoint last_modified_at: 2021-09-14 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.001 - Local Groups - Discovery @@ -37,10 +40,17 @@ The following hunting analytic will identify the use of localgroup discovery usi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr False positives may be present. Tune as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ False positives may be present. Tune as needed. + #### Reference * [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/) diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md index 3b62f3329f..7451952c47 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md @@ -1,6 +1,6 @@ --- title: "PowerShell Get LocalGroup Discovery" -excerpt: "Local Groups" +excerpt: "Permission Groups Discovery, Local Groups" categories: - Endpoint last_modified_at: 2021-09-14 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.001 - Local Groups - Discovery @@ -37,10 +40,17 @@ The following hunting analytic identifies the use of `get-localgroup` being used #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr False positives may be present. Tune as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ False positives may be present. Tune as needed. + #### Reference * [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/) diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md index 2812dcf0ed..4db9a15d7d 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md @@ -1,6 +1,6 @@ --- title: "Powershell Get LocalGroup Discovery with Script Block Logging" -excerpt: "Local Groups" +excerpt: "Permission Groups Discovery, Local Groups" categories: - Endpoint last_modified_at: 2021-09-14 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.001 - Local Groups - Discovery @@ -39,10 +42,17 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | + + + #### Search ``` @@ -76,7 +86,6 @@ To successfully implement this analytic, you will need to enable PowerShell Scri False positives may be present. Tune as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +94,7 @@ False positives may be present. Tune as needed. + #### Reference * [https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html](https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html) diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md index 728eccc346..2f89a8c806 100644 --- a/docs/_posts/2021-09-14-wmic_group_discovery.md +++ b/docs/_posts/2021-09-14-wmic_group_discovery.md @@ -1,6 +1,6 @@ --- title: "Wmic Group Discovery" -excerpt: "Local Groups" +excerpt: "Permission Groups Discovery, Local Groups" categories: - Endpoint last_modified_at: 2021-09-14 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1069 + - Permission Groups Discovery + - Discovery - T1069.001 - Local Groups - Discovery @@ -39,10 +42,17 @@ During triage, review parallel processes and identify any further suspicious beh #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | + + | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | + + + #### Search ``` @@ -84,7 +94,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/) diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md index 7caf49321b..5f9a2a4339 100644 --- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md +++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md @@ -37,11 +37,14 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | + + #### Search ``` @@ -79,7 +82,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +90,7 @@ unknown + #### Reference diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md index af03104393..773d4c0fdb 100644 --- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md +++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md @@ -1,6 +1,6 @@ --- title: "Non Chrome Process Accessing Chrome Default Dir" -excerpt: "Credentials from Web Browsers" +excerpt: "Credentials from Password Stores, Credentials from Web Browsers" categories: - Endpoint last_modified_at: 2021-09-15 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Anomaly + - T1555 + - Credentials from Password Stores + - Credential Access - T1555.003 - Credentials from Web Browsers - Credential Access @@ -37,10 +40,17 @@ This search is to detect an anomaly event of non-chrome process accessing the fi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1555](https://attack.mitre.org/techniques/T1555/) | Credentials from Password Stores | Credential Access | + + | [T1555.003](https://attack.mitre.org/techniques/T1555/003/) | Credentials from Web Browsers | Credential Access | + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you must ingest Windows Security Event lo other browser not listed related to firefox may catch by this rule. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ other browser not listed related to firefox may catch by this rule. + #### Reference diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md index ddf32b3af1..e3b816a7ca 100644 --- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md +++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md @@ -1,6 +1,6 @@ --- title: "Non Firefox Process Access Firefox Profile Dir" -excerpt: "Credentials from Web Browsers" +excerpt: "Credentials from Password Stores, Credentials from Web Browsers" categories: - Endpoint last_modified_at: 2021-09-15 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Anomaly + - T1555 + - Credentials from Password Stores + - Credential Access - T1555.003 - Credentials from Web Browsers - Credential Access @@ -37,10 +40,17 @@ This search is to detect an anomaly event of non-firefox process accessing the f #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1555](https://attack.mitre.org/techniques/T1555/) | Credentials from Password Stores | Credential Access | + + | [T1555.003](https://attack.mitre.org/techniques/T1555/003/) | Credentials from Web Browsers | Credential Access | + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search, you must ingest Windows Security Event lo other browser not listed related to firefox may catch by this rule. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ other browser not listed related to firefox may catch by this rule. + #### Reference diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index 3f3ced3e02..dce7514850 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -1,6 +1,6 @@ --- title: "Account Discovery With Net App" -excerpt: "Domain Account" +excerpt: "Domain Account, Account Discovery" categories: - Endpoint last_modified_at: 2021-09-16 @@ -11,6 +11,9 @@ tags: - T1087.002 - Domain Account - Discovery + - T1087 + - Account Discovery + - Discovery - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ this search is to detect a potential account discovery series of command used by #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + + + + #### Search ``` @@ -84,7 +94,6 @@ To successfully implement this search you need to be ingesting information on pr admin or power user may used this series of command. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ admin or power user may used this series of command. + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index 17dcb34226..fd45a5ecab 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -1,6 +1,6 @@ --- title: "Attempt To Add Certificate To Untrusted Store" -excerpt: "Install Root Certificate" +excerpt: "Install Root Certificate, Subvert Trust Controls" categories: - Endpoint last_modified_at: 2021-09-16 @@ -11,6 +11,9 @@ tags: - T1553.004 - Install Root Certificate - Defense Evasion + - T1553 + - Subvert Trust Controls + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +41,17 @@ Attempt To Add Certificate To Untrusted Store #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1553.004](https://attack.mitre.org/techniques/T1553/004/) | Install Root Certificate | Defense Evasion | + +| [T1553](https://attack.mitre.org/techniques/T1553/) | Subvert Trust Controls | Defense Evasion | + + + + + #### Search ``` @@ -81,7 +91,6 @@ You must be ingesting data that records process activity from your hosts to popu There may be legitimate reasons for administrators to add a certificate to the untrusted certificate store. In such cases, this will typically be done on a large number of systems. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ There may be legitimate reasons for administrators to add a certificate to the u + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md) diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index fcc6793998..f470bb422b 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -1,6 +1,6 @@ --- title: "Attempted Credential Dump From Registry via Reg exe" -excerpt: "Security Account Manager" +excerpt: "Security Account Manager, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-09-16 @@ -11,6 +11,9 @@ tags: - T1003.002 - Security Account Manager - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ None identified. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets) diff --git a/docs/_posts/2021-09-16-batch_file_write_to_system32.md b/docs/_posts/2021-09-16-batch_file_write_to_system32.md index af49ba77a6..fdabb3b3bf 100644 --- a/docs/_posts/2021-09-16-batch_file_write_to_system32.md +++ b/docs/_posts/2021-09-16-batch_file_write_to_system32.md @@ -1,6 +1,6 @@ --- title: "Batch File Write to System32" -excerpt: "Malicious File" +excerpt: "User Execution, Malicious File" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1204 + - User Execution + - Execution - T1204.002 - Malicious File - Execution @@ -37,10 +40,17 @@ The search looks for a batch file (.bat) written to the Windows system directory #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | + + | [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr It is possible for this search to generate a notable event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ It is possible for this search to generate a notable event for a batch file writ + #### Reference diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index 0bd833cf55..43b9031329 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -38,11 +38,14 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1197](https://attack.mitre.org/techniques/T1197/) | BITS Jobs | Defense Evasion, Persistence | + + #### Search ``` @@ -84,7 +87,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives will be present. Typically, applications will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments (legitimate applications) or parent process. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +95,7 @@ Limited false positives will be present. Typically, applications will use `BitsA + #### Reference * [https://attack.mitre.org/techniques/T1197/](https://attack.mitre.org/techniques/T1197/) diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index b2a095bd5f..3a65ff0ce7 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -41,12 +41,18 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1197](https://attack.mitre.org/techniques/T1197/) | BITS Jobs | Defense Evasion, Persistence | + + + | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | + + #### Search ``` @@ -90,7 +96,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives, however it may be required to filter based on parent process name or network connection. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -99,6 +104,7 @@ Limited false positives, however it may be required to filter based on parent pr + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download](https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download) diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index 231b300b44..c15f94872a 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -1,6 +1,6 @@ --- title: "Creation of Shadow Copy with wmic and powershell" -excerpt: "NTDS" +excerpt: "NTDS, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-09-16 @@ -11,6 +11,9 @@ tags: - T1003.003 - NTDS - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Legtimate administrator usage of wmic to create a shadow copy. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Legtimate administrator usage of wmic to create a shadow copy. + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index 22f74ed622..c37089737e 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -1,6 +1,6 @@ --- title: "Credential Dumping via Copy Command from Shadow Copy" -excerpt: "NTDS" +excerpt: "NTDS, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-09-16 @@ -11,6 +11,9 @@ tags: - T1003.003 - NTDS - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search detects credential dumping using copy command from a shadow copy. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ unknown + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index 2d28a7dbbc..79c3a4d4b7 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -1,6 +1,6 @@ --- title: "Credential Dumping via Symlink to Shadow Copy" -excerpt: "NTDS" +excerpt: "NTDS, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-09-16 @@ -11,6 +11,9 @@ tags: - T1003.003 - NTDS - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search detects the creation of a symlink to a shadow copy. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ unknown + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2021-09-16-detect_html_help_renamed.md b/docs/_posts/2021-09-16-detect_html_help_renamed.md index 94535c8421..358a4d1412 100644 --- a/docs/_posts/2021-09-16-detect_html_help_renamed.md +++ b/docs/_posts/2021-09-16-detect_html_help_renamed.md @@ -1,6 +1,6 @@ --- title: "Detect HTML Help Renamed" -excerpt: "Compiled HTML File" +excerpt: "Signed Binary Proxy Execution, Compiled HTML File" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.001 - Compiled HTML File - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Although unlikely a renamed instance of hh.exe will be used legitimately, filter + #### Reference * [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/) diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index a0a6e85c38..68e096266a 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -1,6 +1,6 @@ --- title: "Detect HTML Help URL in Command Line" -excerpt: "Compiled HTML File" +excerpt: "Signed Binary Proxy Execution, Compiled HTML File" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.001 - Compiled HTML File - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Although unlikely, some legitimate applications may retrieve a CHM remotely, fil + #### Reference * [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/) diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index a2696a7605..837abc9e6a 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -1,6 +1,6 @@ --- title: "Detect HTML Help Using InfoTech Storage Handlers" -excerpt: "Compiled HTML File" +excerpt: "Signed Binary Proxy Execution, Compiled HTML File" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.001 - Compiled HTML File - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr It is rare to see instances of InfoTech Storage Handlers being used, but it does happen in some legitimate instances. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ It is rare to see instances of InfoTech Storage Handlers being used, but it does + #### Reference * [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/) diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index 9d80c21654..da10509dcc 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -1,6 +1,6 @@ --- title: "Detect mshta inline hta execution" -excerpt: "Mshta" +excerpt: "Signed Binary Proxy Execution, Mshta" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.005 - Mshta - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies "mshta.exe" execution with inline prot #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg + #### Reference * [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses) diff --git a/docs/_posts/2021-09-16-detect_mshta_renamed.md b/docs/_posts/2021-09-16-detect_mshta_renamed.md index a881084da7..2f9b9ab1df 100644 --- a/docs/_posts/2021-09-16-detect_mshta_renamed.md +++ b/docs/_posts/2021-09-16-detect_mshta_renamed.md @@ -1,6 +1,6 @@ --- title: "Detect mshta renamed" -excerpt: "Mshta" +excerpt: "Signed Binary Proxy Execution, Mshta" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.005 - Mshta - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may use a moved copy of mshta.exe, but never renamed, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Although unlikely, some legitimate applications may use a moved copy of mshta.ex + #### Reference * [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses) diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 09f2b553ca..88bcadcfb3 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -1,6 +1,6 @@ --- title: "Detect MSHTA Url in Command Line" -excerpt: "Mshta" +excerpt: "Signed Binary Proxy Execution, Mshta" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.005 - Mshta - Defense Evasion @@ -37,10 +40,17 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr It is possible legitimate applications may perform this behavior and will need to be filtered. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ It is possible legitimate applications may perform this behavior and will need t + #### Reference * [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses) diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index 406a82c40d..ca9f94659d 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -1,6 +1,6 @@ --- title: "Detect PsExec With accepteula Flag" -excerpt: "SMB/Windows Admin Shares" +excerpt: "Remote Services, SMB/Windows Admin Shares" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1021 + - Remote Services + - Lateral Movement - T1021.002 - SMB/Windows Admin Shares - Lateral Movement @@ -37,10 +40,17 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | + + | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | + + + #### Search ``` @@ -86,7 +96,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine - #### RBA | Risk Score | Impact | Confidence | Message | @@ -95,6 +104,7 @@ Administrators can leverage PsExec for accessing remote systems and might pass ` + #### Reference diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md index 5bfa53c9af..0c9ec8c7bc 100644 --- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md +++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md @@ -1,6 +1,6 @@ --- title: "Detect Renamed 7-Zip" -excerpt: "Archive via Utility" +excerpt: "Archive via Utility, Archive Collected Data" categories: - Endpoint last_modified_at: 2021-09-16 @@ -11,6 +11,9 @@ tags: - T1560.001 - Archive via Utility - Collection + - T1560 + - Archive Collected Data + - Collection - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1560.001](https://attack.mitre.org/techniques/T1560/001/) | Archive via Utility | Collection | + +| [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection | + + + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Limited false positives, however this analytic will need to be modified for each + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md) diff --git a/docs/_posts/2021-09-16-detect_renamed_psexec.md b/docs/_posts/2021-09-16-detect_renamed_psexec.md index f14b652ac3..1f3614ac69 100644 --- a/docs/_posts/2021-09-16-detect_renamed_psexec.md +++ b/docs/_posts/2021-09-16-detect_renamed_psexec.md @@ -1,6 +1,6 @@ --- title: "Detect Renamed PSExec" -excerpt: "Service Execution" +excerpt: "System Services, Service Execution" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1569 + - System Services + - Execution - T1569.002 - Service Execution - Execution @@ -39,10 +42,17 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution | + + | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | + + + #### Search ``` @@ -90,7 +100,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -99,6 +108,7 @@ Limited false positives should be present. It is possible some third party appli + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml) diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md index f38e950d7d..c820aedd4e 100644 --- a/docs/_posts/2021-09-16-detect_renamed_rclone.md +++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md @@ -36,11 +36,14 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration | + + #### Search ``` @@ -83,7 +86,6 @@ To successfully implement this search you need to be ingesting information on pr False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +94,7 @@ False positives should be limited as this analytic identifies renamed instances + #### Reference * [https://redcanary.com/blog/rclone-mega-extortion/](https://redcanary.com/blog/rclone-mega-extortion/) diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md index 35ca37e570..912ea467df 100644 --- a/docs/_posts/2021-09-16-detect_renamed_winrar.md +++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md @@ -1,6 +1,6 @@ --- title: "Detect Renamed WinRAR" -excerpt: "Archive via Utility" +excerpt: "Archive via Utility, Archive Collected Data" categories: - Endpoint last_modified_at: 2021-09-16 @@ -11,6 +11,9 @@ tags: - T1560.001 - Archive via Utility - Collection + - T1560 + - Archive Collected Data + - Collection - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +41,17 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1560.001](https://attack.mitre.org/techniques/T1560/001/) | Archive via Utility | Collection | + +| [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection | + + + + + #### Search ``` @@ -84,7 +94,6 @@ To successfully implement this search you need to be ingesting information on pr Unknown. It is possible third party applications use renamed instances of WinRAR. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -93,6 +102,7 @@ Unknown. It is possible third party applications use renamed instances of WinRAR + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md) diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index 3ef511b647..5f79a4fa07 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -1,6 +1,6 @@ --- title: "Dump LSASS via procdump" -excerpt: "LSASS Memory" +excerpt: "LSASS Memory, OS Credential Dumping" categories: - Endpoint last_modified_at: 2021-09-16 @@ -11,6 +11,9 @@ tags: - T1003.001 - LSASS Memory - Credential Access + - T1003 + - OS Credential Dumping + - Credential Access - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +41,17 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + #### Search ``` @@ -80,7 +90,6 @@ To successfully implement this search you need to be ingesting information on pr None identified. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -89,6 +98,7 @@ None identified. + #### Reference * [https://attack.mitre.org/techniques/T1003/001/](https://attack.mitre.org/techniques/T1003/001/) diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index 534dfb389e..958506e34f 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -1,6 +1,6 @@ --- title: "Local Account Discovery with Net" -excerpt: "Local Account" +excerpt: "Account Discovery, Local Account" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1087 + - Account Discovery + - Discovery - T1087.001 - Local Account - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | + + + #### Search ``` @@ -71,7 +81,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -80,6 +89,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index e52353e196..44553e708a 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -1,6 +1,6 @@ --- title: "Local Account Discovery With Wmic" -excerpt: "Local Account" +excerpt: "Account Discovery, Local Account" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1087 + - Account Discovery + - Discovery - T1087.001 - Local Account - Discovery @@ -37,10 +40,17 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | + + | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | + + + #### Search ``` @@ -71,7 +81,6 @@ To successfully implement this search you need to be ingesting information on pr Administrators or power users may use this command for troubleshooting. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -80,6 +89,7 @@ Administrators or power users may use this command for troubleshooting. + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index 5ce30328ff..e6af46b2c2 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -1,6 +1,6 @@ --- title: "Office Product Spawning Wmic" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-09-16 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ The following detection identifies the latest behavior utilized by Ursnif malwar #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr No false positives known. Filter as needed. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ No false positives known. Filter as needed. + #### Reference * [https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/](https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/) diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index 400a19493f..8cf4892535 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -1,6 +1,6 @@ --- title: "Processes launching netsh" -excerpt: "Disable or Modify System Firewall" +excerpt: "Disable or Modify System Firewall, Impair Defenses" categories: - Endpoint last_modified_at: 2021-09-16 @@ -11,6 +11,9 @@ tags: - T1562.004 - Disable or Modify System Firewall - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1562.004](https://attack.mitre.org/techniques/T1562/004/) | Disable or Modify System Firewall | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + #### Search ``` @@ -79,7 +89,6 @@ To successfully implement this search you need to be ingesting information on pr Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -88,6 +97,7 @@ Some VPN applications are known to launch netsh.exe. Outside of these instances, + #### Reference diff --git a/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md index 29daeb29d8..02f94fc0b8 100644 --- a/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md @@ -1,6 +1,6 @@ --- title: "Detect Regasm with no Command Line Arguments" -excerpt: "Regsvcs/Regasm" +excerpt: "Signed Binary Proxy Execution, Regsvcs/Regasm" categories: - Endpoint last_modified_at: 2021-09-20 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.009 - Regsvcs/Regasm - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies regasm.exe with no command line arguments. Thi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ Although unlikely, limited instances of regasm.exe or may cause a false positive + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md index 869f008695..434af6a26f 100644 --- a/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md @@ -1,6 +1,6 @@ --- title: "Detect Regsvcs with No Command Line Arguments" -excerpt: "Regsvcs/Regasm" +excerpt: "Signed Binary Proxy Execution, Regsvcs/Regasm" categories: - Endpoint last_modified_at: 2021-09-20 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.009 - Regsvcs/Regasm - Defense Evasion @@ -37,10 +40,17 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | + + + #### Search ``` @@ -83,7 +93,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -92,6 +101,7 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive. + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md index 3aeb112778..14fc445057 100644 --- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md +++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md @@ -1,6 +1,6 @@ --- title: "Office Document Spawned Child Process To Download" -excerpt: "Spearphishing Attachment" +excerpt: "Phishing, Spearphishing Attachment" categories: - Endpoint last_modified_at: 2021-09-20 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1566 + - Phishing + - Initial Access - T1566.001 - Spearphishing Attachment - Initial Access @@ -37,10 +40,17 @@ This search is to detect potential malicious office document executing lolbin ch #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + + | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + + + #### Search ``` @@ -82,7 +92,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Default browser not in the filter list. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -91,6 +100,7 @@ Default browser not in the filter list. + #### Reference * [https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#](https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#) diff --git a/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md index defc7b368c..9e1cfc6870 100644 --- a/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md @@ -38,11 +38,14 @@ The following analytic identifies DLLHost.exe with no command line arguments. It #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -85,7 +88,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives may be present in small environments. Tuning may be required based on parent process. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +96,7 @@ Limited false positives may be present in small environments. Tuning may be requ + #### Reference * [https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile](https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile) diff --git a/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md index 0eb31db494..a6f04ffddf 100644 --- a/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md @@ -38,11 +38,14 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -85,7 +88,6 @@ To successfully implement this search, you need to be ingesting logs with the pr Limited false positives may be present in small environments. Tuning may be required based on parent process. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +96,7 @@ Limited false positives may be present in small environments. Tuning may be requ + #### Reference * [https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile](https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile) diff --git a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md index b43daedddf..ee62c0c27d 100644 --- a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md +++ b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md @@ -1,6 +1,6 @@ --- title: "Suspicious microsoft workflow compiler rename" -excerpt: "Trusted Developer Utilities Proxy Execution, Rename System Utilities" +excerpt: "Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities" categories: - Endpoint last_modified_at: 2021-09-20 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - Hunting + - T1036 + - Masquerading + - Defense Evasion - T1127 - Trusted Developer Utilities Proxy Execution - Defense Evasion @@ -40,11 +43,21 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + + + | [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion | + + | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | + + + #### Search ``` @@ -88,7 +101,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may use a moved copy of microsoft.workflow.compiler.exe, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -97,6 +109,7 @@ Although unlikely, some legitimate applications may use a moved copy of microsof + #### Reference * [https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/](https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/) diff --git a/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md index db121561bc..df83627a5a 100644 --- a/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md @@ -1,6 +1,6 @@ --- title: "Suspicious Rundll32 no Command Line Arguments" -excerpt: "Rundll32" +excerpt: "Signed Binary Proxy Execution, Rundll32" categories: - Endpoint last_modified_at: 2021-09-20 @@ -8,12 +8,16 @@ toc: true toc_label: "" tags: - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion - T1218.011 - Rundll32 - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - CVE-2021-34527 - Endpoint - Actions on Objectives --- @@ -37,10 +41,17 @@ The following analytic identifies rundll32.exe with no command line arguments. I #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + #### Search ``` @@ -85,7 +96,6 @@ To successfully implement this search you need to be ingesting information on pr Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +104,14 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | + + + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md index 6c8349df28..682cb4ac09 100644 --- a/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md @@ -38,11 +38,14 @@ The following analytic identifies searchprotocolhost.exe with no command line ar #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + #### Search ``` @@ -85,7 +88,6 @@ To successfully implement this search you need to be ingesting information on pr Limited false positives may be present in small environments. Tuning may be required based on parent process. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +96,7 @@ Limited false positives may be present in small environments. Tuning may be requ + #### Reference * [https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc](https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc) diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md index 00e4f20c6d..803756d04b 100644 --- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md +++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md @@ -37,11 +37,14 @@ This search is to detect file creation in remcos folder in appdata which is the #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection | + + #### Search ``` @@ -76,7 +79,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -85,6 +87,7 @@ unknown + #### Reference * [https://success.trendmicro.com/solution/1123281-remcos-malware-information](https://success.trendmicro.com/solution/1123281-remcos-malware-information) diff --git a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md index ffde824d49..ff954f11e8 100644 --- a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md @@ -37,11 +37,14 @@ This search is to detect a suspicious creation of image in appdata folder made b #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection | + + #### Search ``` @@ -81,7 +84,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +92,7 @@ unknown + #### Reference * [https://success.trendmicro.com/solution/1123281-remcos-malware-information](https://success.trendmicro.com/solution/1123281-remcos-malware-information) diff --git a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md index a50f345c8c..a5d12022e3 100644 --- a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md @@ -37,11 +37,14 @@ This analytic is to detect a suspicious creation of .wav file in appdata folder. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection | + + #### Search ``` @@ -81,7 +84,6 @@ To successfully implement this search, you need to be ingesting logs with the pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +92,7 @@ unknown + #### Reference * [https://success.trendmicro.com/solution/1123281-remcos-malware-information](https://success.trendmicro.com/solution/1123281-remcos-malware-information) diff --git a/docs/_posts/2021-09-24-remcos_client_registry_install_entry.md b/docs/_posts/2021-09-24-remcos_client_registry_install_entry.md index 7f6fa67816..64556537bd 100644 --- a/docs/_posts/2021-09-24-remcos_client_registry_install_entry.md +++ b/docs/_posts/2021-09-24-remcos_client_registry_install_entry.md @@ -37,11 +37,14 @@ This search detects registry key license at host where Remcos RAT agent is insta #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + + #### Search ``` @@ -77,7 +80,6 @@ To successfully implement this search you need to be ingesting information on pr unknown - #### RBA | Risk Score | Impact | Confidence | Message | @@ -86,6 +88,7 @@ unknown + #### Reference * [https://attack.mitre.org/software/S0332/](https://attack.mitre.org/software/S0332/) diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md new file mode 100644 index 0000000000..5a490f5668 --- /dev/null +++ b/docs/_posts/2021-09-27-change_default_file_association.md @@ -0,0 +1,115 @@ +--- +title: "Change Default File Association" +excerpt: "Change Default File Association, Event Triggered Execution" +categories: + - Endpoint +last_modified_at: 2021-09-27 +toc: true +toc_label: "" +tags: + - TTP + - T1546.001 + - Change Default File Association + - Privilege Escalation + - Persistence + - T1546 + - Event Triggered Execution + - Privilege Escalation + - Persistence + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other payload that will load malicious command to the compromised host. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-09-27 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 462d17d8-1f71-11ec-ad07-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1546.001](https://attack.mitre.org/techniques/T1546/001/) | Change Default File Association | Privilege Escalation, Persistence | + + + +| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Privilege Escalation, Persistence | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `change_default_file_association_filter` +``` + +#### Associated Analytic Story +* [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Windows Privilege Escalation](/stories/windows_privilege_escalation) + + +#### How To Implement +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +#### Required field +* _time +* Registry.dest +* Registry.user +* Registry.registry_path +* Registry.registry_key_name +* Registry.registry_value_name + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +unknown + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | + + + + +#### Reference + +* [https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features](https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/change_default_file_association.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md new file mode 100644 index 0000000000..3b72af1567 --- /dev/null +++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md @@ -0,0 +1,115 @@ +--- +title: "Logon Script Event Trigger Execution" +excerpt: "Boot or Logon Initialization Scripts, Logon Script (Windows)" +categories: + - Endpoint +last_modified_at: 2021-09-27 +toc: true +toc_label: "" +tags: + - TTP + - T1037 + - Boot or Logon Initialization Scripts + - Persistence + - Privilege Escalation + - T1037.001 + - Logon Script (Windows) + - Persistence + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-09-27 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 4c38c264-1f74-11ec-b5fa-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1037](https://attack.mitre.org/techniques/T1037/) | Boot or Logon Initialization Scripts | Persistence, Privilege Escalation | + + +| [T1037.001](https://attack.mitre.org/techniques/T1037/001/) | Logon Script (Windows) | Persistence, Privilege Escalation | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `logon_script_event_trigger_execution_filter` +``` + +#### Associated Analytic Story +* [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Windows Privilege Escalation](/stories/windows_privilege_escalation) + + +#### How To Implement +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +#### Required field +* _time +* Registry.dest +* Registry.user +* Registry.registry_path +* Registry.registry_key_name +* Registry.registry_value_name + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +unknown + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | + + + + +#### Reference + +* [https://attack.mitre.org/techniques/T1037/001](https://attack.mitre.org/techniques/T1037/001) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/logon_script_event_trigger_execution.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md new file mode 100644 index 0000000000..756516b423 --- /dev/null +++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md @@ -0,0 +1,116 @@ +--- +title: "Screensaver Event Trigger Execution" +excerpt: "Event Triggered Execution, Screensaver" +categories: + - Endpoint +last_modified_at: 2021-09-27 +toc: true +toc_label: "" +tags: + - TTP + - T1546 + - Event Triggered Execution + - Privilege Escalation + - Persistence + - T1546.002 + - Screensaver + - Privilege Escalation + - Persistence + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-09-27 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 58cea3ec-1f6d-11ec-8560-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Privilege Escalation, Persistence | + + +| [T1546.002](https://attack.mitre.org/techniques/T1546/002/) | Screensaver | Privilege Escalation, Persistence | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `screensaver_event_trigger_execution_filter` +``` + +#### Associated Analytic Story +* [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Windows Privilege Escalation](/stories/windows_privilege_escalation) + + +#### How To Implement +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +#### Required field +* _time +* Registry.dest +* Registry.user +* Registry.registry_path +* Registry.registry_key_name +* Registry.registry_value_name + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +unknown + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 72.0 | 80 | 90 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | + + + + +#### Reference + +* [https://attack.mitre.org/techniques/T1546/002/](https://attack.mitre.org/techniques/T1546/002/) +* [https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver](https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/screensaver_event_trigger_execution.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-09-28-active_setup_registry_autostart.md b/docs/_posts/2021-09-28-active_setup_registry_autostart.md new file mode 100644 index 0000000000..0e8e12d2f9 --- /dev/null +++ b/docs/_posts/2021-09-28-active_setup_registry_autostart.md @@ -0,0 +1,116 @@ +--- +title: "Active Setup Registry Autostart" +excerpt: "Active Setup, Boot or Logon Autostart Execution" +categories: + - Endpoint +last_modified_at: 2021-09-28 +toc: true +toc_label: "" +tags: + - TTP + - T1547.014 + - Active Setup + - Persistence + - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-09-28 +- **Author**: Teoderick Contreras, Splunk +- **ID**: f64579c0-203f-11ec-abcc-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1547.014](https://attack.mitre.org/techniques/T1547/014/) | Active Setup | Persistence, Privilege Escalation | + + + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `active_setup_registry_autostart_filter` +``` + +#### Associated Analytic Story +* [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Windows Privilege Escalation](/stories/windows_privilege_escalation) + + +#### How To Implement +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +#### Required field +* _time +* Registry.dest +* Registry.user +* Registry.registry_path +* Registry.registry_key_name +* Registry.registry_value_name + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +Active setup installer may add or modify this registry. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 64.0 | 80 | 80 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | + + + + +#### Reference + +* [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E) +* [https://attack.mitre.org/techniques/T1547/014/](https://attack.mitre.org/techniques/T1547/014/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/active_setup_registry_autostart.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md new file mode 100644 index 0000000000..9ca5d11f25 --- /dev/null +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -0,0 +1,118 @@ +--- +title: "Print Processor Registry Autostart" +excerpt: "Print Processors, Boot or Logon Autostart Execution" +categories: + - Endpoint +last_modified_at: 2021-09-28 +toc: true +toc_label: "" +tags: + - TTP + - T1547.012 + - Print Processors + - Persistence + - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + +### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION +We have not been able to test, simulate or build datasets for it, use at your own risk! + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious modification or new registry entry regarding print processor. This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine. This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-09-28 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 1f5b68aa-2037-11ec-898e-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | + + + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `print_processor_registry_autostart_filter` +``` + +#### Associated Analytic Story +* [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Windows Privilege Escalation](/stories/windows_privilege_escalation) + + +#### How To Implement +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +#### Required field +* _time +* Registry.dest +* Registry.user +* Registry.registry_path +* Registry.registry_key_name +* Registry.registry_value_name + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +possible new printer installation may add driver component on this registry. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | + + + + +#### Reference + +* [https://attack.mitre.org/techniques/T1547/012/](https://attack.mitre.org/techniques/T1547/012/) +* [https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/](https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/print_processor_registry_autostart.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-09-29-disable_uac_remote_restriction.md b/docs/_posts/2021-09-29-disable_uac_remote_restriction.md new file mode 100644 index 0000000000..97f726217b --- /dev/null +++ b/docs/_posts/2021-09-29-disable_uac_remote_restriction.md @@ -0,0 +1,116 @@ +--- +title: "Disable UAC Remote Restriction" +excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism" +categories: + - Endpoint +last_modified_at: 2021-09-29 +toc: true +toc_label: "" +tags: + - TTP + - T1548.002 + - Bypass User Account Control + - Privilege Escalation + - Defense Evasion + - T1548 + - Abuse Elevation Control Mechanism + - Privilege Escalation + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-09-29 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 9928b732-210e-11ec-b65e-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | + + + +| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `disable_uac_remote_restriction_filter` +``` + +#### Associated Analytic Story +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) +* [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities) + + +#### How To Implement +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +#### Required field +* _time +* Registry.dest +* Registry.user +* Registry.registry_path +* Registry.registry_key_name +* Registry.registry_value_name +* Registry.registry_value_data + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +admin may set this policy for non-critical machine. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | + + + + +#### Reference + +* [https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction](https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_uac_remote_restriction.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-09-29-time_provider_persistence_registry.md b/docs/_posts/2021-09-29-time_provider_persistence_registry.md new file mode 100644 index 0000000000..6a60191f81 --- /dev/null +++ b/docs/_posts/2021-09-29-time_provider_persistence_registry.md @@ -0,0 +1,116 @@ +--- +title: "Time Provider Persistence Registry" +excerpt: "Time Providers, Boot or Logon Autostart Execution" +categories: + - Endpoint +last_modified_at: 2021-09-29 +toc: true +toc_label: "" +tags: + - TTP + - T1547.003 + - Time Providers + - Persistence + - Privilege Escalation + - T1547 + - Boot or Logon Autostart Execution + - Persistence + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-09-29 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 5ba382c4-2105-11ec-8d8f-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1547.003](https://attack.mitre.org/techniques/T1547/003/) | Time Providers | Persistence, Privilege Escalation | + + + +| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `time_provider_persistence_registry_filter` +``` + +#### Associated Analytic Story +* [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Windows Privilege Escalation](/stories/windows_privilege_escalation) + + +#### How To Implement +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +#### Required field +* _time +* Registry.dest +* Registry.user +* Registry.registry_path +* Registry.registry_key_name +* Registry.registry_value_name + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +unknown + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | + + + + +#### Reference + +* [https://pentestlab.blog/2019/10/22/persistence-time-providers/](https://pentestlab.blog/2019/10/22/persistence-time-providers/) +* [https://attack.mitre.org/techniques/T1547/003/](https://attack.mitre.org/techniques/T1547/003/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/time_provider_persistence_registry.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md new file mode 100644 index 0000000000..1943b5ce2e --- /dev/null +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -0,0 +1,119 @@ +--- +title: "Verclsid CLSID Execution" +excerpt: "Verclsid, Signed Binary Proxy Execution" +categories: + - Endpoint +last_modified_at: 2021-09-29 +toc: true +toc_label: "" +tags: + - Hunting + - T1218.012 + - Verclsid + - Defense Evasion + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not. + +- **Type**: Hunting +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-09-29 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 61e9a56a-20fa-11ec-8ba3-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1218.012](https://attack.mitre.org/techniques/T1218/012/) | Verclsid | Defense Evasion | + + + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_verclsid` AND Processes.process="*/S*" Processes.process="*/C*" AND Processes.process="*{*" AND Processes.process="*}*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `verclsid_clsid_execution_filter` +``` + +#### Associated Analytic Story +* [Unusual Processes](/stories/unusual_processes) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +windows can used this application for its normal COM object validation. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 25.0 | 50 | 50 | process $process_name$ to execute possible clsid commandline $process$ in $dest$ | + + + + +#### Reference + +* [https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5](https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5) +* [https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/](https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/verclsid_clsid_execution.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md new file mode 100644 index 0000000000..5e0c8ddf49 --- /dev/null +++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md @@ -0,0 +1,119 @@ +--- +title: "Vbscript Execution Using Wscript App" +excerpt: "Visual Basic, Command and Scripting Interpreter" +categories: + - Endpoint +last_modified_at: 2021-10-01 +toc: true +toc_label: "" +tags: + - TTP + - T1059.005 + - Visual Basic + - Execution + - T1059 + - Command and Scripting Interpreter + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious wscript commandline to execute vbscript. This technique was seen in several malware to execute malicious vbs file using wscript application. commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or even some av script emulation system. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-01 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 35159940-228f-11ec-8a49-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1059.005](https://attack.mitre.org/techniques/T1059/005/) | Visual Basic | Execution | + + + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "wscript.exe" AND Processes.parent_process = "*//e:vbscript*") OR (Processes.process_name = "wscript.exe" AND Processes.process = "*//e:vbscript*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `vbscript_execution_using_wscript_app_filter` +``` + +#### Associated Analytic Story +* [FIN7](/stories/fin7) +* [Remcos](/stories/remcos) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +unknown + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Process name $process_name$ with commandline $process$ to execute vbsscript | + + + + +#### Reference + +* [https://www.joesandbox.com/analysis/369332/0/html](https://www.joesandbox.com/analysis/369332/0/html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md new file mode 100644 index 0000000000..754a545712 --- /dev/null +++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md @@ -0,0 +1,113 @@ +--- +title: "MSBuild Suspicious Spawned By Script Process" +excerpt: "MSBuild, Trusted Developer Utilities Proxy Execution" +categories: + - Endpoint +last_modified_at: 2021-10-04 +toc: true +toc_label: "" +tags: + - TTP + - T1127.001 + - MSBuild + - Defense Evasion + - T1127 + - Trusted Developer Utilities Proxy Execution + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the compromised host. During triage, review parallel processes and identify any file modifications. MSBuild may load a script from the same path without having command-line arguments. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-04 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 213b3148-24ea-11ec-93a2-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion | + + + +| [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("wscript.exe", "cscript.exe") AND `process_msbuild` by Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `msbuild_suspicious_spawned_by_script_process_filter` +``` + +#### Associated Analytic Story +* [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* Processes.dest +* Processes.parent_process +* Processes.parent_process_name +* Processes.process_name +* Processes.original_file_name +* Processes.user + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +False positives should be limited as developers do not spawn MSBuild via a WSH. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$ | + + + + +#### Reference + +* [https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#](https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-04-regsvr32_silent_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_param_dll_loading.md new file mode 100644 index 0000000000..a104b351ed --- /dev/null +++ b/docs/_posts/2021-10-04-regsvr32_silent_param_dll_loading.md @@ -0,0 +1,119 @@ +--- +title: "Regsvr32 Silent Param Dll Loading" +excerpt: "Signed Binary Proxy Execution, Regsvr32" +categories: + - Endpoint +last_modified_at: 2021-10-04 +toc: true +toc_label: "" +tags: + - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion + - T1218.010 + - Regsvr32 + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-04 +- **Author**: Teoderick Contreras, Splunk +- **ID**: f421c250-24e7-11ec-bc43-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + +| [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe Processes.process="*/i*" Processes.process="*/s*" by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `regsvr32_silent_param_dll_loading_filter` +``` + +#### Associated Analytic Story +* [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity) + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +Other third part application may used this parameter but not so common in base windows environment. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 36.0 | 60 | 60 | regsvr32 process with $process$ commandline in $dest$ | + + + + +#### Reference + +* [https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#](https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#) +* [https://attack.mitre.org/techniques/T1218/010/](https://attack.mitre.org/techniques/T1218/010/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/regsvr32_silent_param_dll_loading.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-05-detect_exchange_web_shell.md b/docs/_posts/2021-10-05-detect_exchange_web_shell.md index 98d1959118..7b2f8551be 100644 --- a/docs/_posts/2021-10-05-detect_exchange_web_shell.md +++ b/docs/_posts/2021-10-05-detect_exchange_web_shell.md @@ -1,6 +1,6 @@ --- title: "Detect Exchange Web Shell" -excerpt: "Web Shell" +excerpt: "Server Software Component, Web Shell" categories: - Endpoint last_modified_at: 2021-10-05 @@ -8,6 +8,9 @@ toc: true toc_label: "" tags: - TTP + - T1505 + - Server Software Component + - Persistence - T1505.003 - Web Shell - Persistence @@ -37,10 +40,17 @@ The following query identifies suspicious .aspx created in 3 paths identified by #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + +| [T1505](https://attack.mitre.org/techniques/T1505/) | Server Software Component | Persistence | + + | [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence | + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search you need to be ingesting information on pr The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ The query is structured in a way that `action` (read, create) is not defined. Re + #### Reference * [https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv) diff --git a/docs/_posts/2021-10-05-disable_security_logs_using_minint_registry.md b/docs/_posts/2021-10-05-disable_security_logs_using_minint_registry.md new file mode 100644 index 0000000000..a9d371a1c1 --- /dev/null +++ b/docs/_posts/2021-10-05-disable_security_logs_using_minint_registry.md @@ -0,0 +1,106 @@ +--- +title: "Disable Security Logs Using MiniNt Registry" +excerpt: "Modify Registry" +categories: + - Endpoint +last_modified_at: 2021-10-05 +toc: true +toc_label: "" +tags: + - TTP + - T1112 + - Modify Registry + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-05 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 39ebdc68-25b9-11ec-aec7-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `disable_security_logs_using_minint_registry_filter` +``` + +#### Associated Analytic Story +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) + + +#### How To Implement +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +#### Required field +* _time +* Registry.dest +* Registry.user +* Registry.registry_value_name +* Registry.registry_key_name +* Registry.registry_path +* Registry.registry_value_data + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +Unknown. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | + + + + +#### Reference + +* [https://twitter.com/0gtweet/status/1182516740955226112](https://twitter.com/0gtweet/status/1182516740955226112) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disable_security_logs_using_minint_registry.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-05-enable_wdigest_uselogoncredential_registry.md b/docs/_posts/2021-10-05-enable_wdigest_uselogoncredential_registry.md new file mode 100644 index 0000000000..10c1c2c597 --- /dev/null +++ b/docs/_posts/2021-10-05-enable_wdigest_uselogoncredential_registry.md @@ -0,0 +1,113 @@ +--- +title: "Enable WDigest UseLogonCredential Registry" +excerpt: "Modify Registry, OS Credential Dumping" +categories: + - Endpoint +last_modified_at: 2021-10-05 +toc: true +toc_label: "" +tags: + - TTP + - T1112 + - Modify Registry + - Defense Evasion + - T1003 + - OS Credential Dumping + - Credential Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-05 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 0c7d8ffe-25b1-11ec-9f39-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + + + +| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `enable_wdigest_uselogoncredential_registry_filter` +``` + +#### Associated Analytic Story +* [Credential Dumping](/stories/credential_dumping) + + +#### How To Implement +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +#### Required field +* _time +* Registry.dest +* Registry.user +* Registry.registry_value_name +* Registry.registry_key_name +* Registry.registry_path +* Registry.registry_value_data + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +unknown + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | wdigest registry $registry_path$ was modified in $dest$ | + + + + +#### Reference + +* [https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html](https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md new file mode 100644 index 0000000000..bc190505e2 --- /dev/null +++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md @@ -0,0 +1,121 @@ +--- +title: "Malicious InProcServer32 Modification" +excerpt: "Regsvr32, Modify Registry" +categories: + - Endpoint +last_modified_at: 2021-10-05 +toc: true +toc_label: "" +tags: + - TTP + - T1218.010 + - Regsvr32 + - Defense Evasion + - T1112 + - Modify Registry + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID). Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-05 +- **Author**: Michael Haag, Splunk +- **ID**: 127c8d08-25ff-11ec-9223-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | + + + +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user +| `drop_dm_object_name(Processes)` +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest Registry.process_guid Registry.user +| `drop_dm_object_name(Registry)` +| fields _time dest registry_path registry_key_name registry_value_name process_name process_path process process_guid user] +| stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name registry_path registry_key_name registry_value_name user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `malicious_inprocserver32_modification_filter` +``` + +#### Associated Analytic Story +* [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity) +* [Remcos](/stories/remcos) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* dest +* process_name +* registry_path +* registry_key_name +* registry_value_name +* user + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | The $process_name$ was identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32. | + + + + +#### Reference + +* [https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/](https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/) +* [https://tria.ge/210929-ap75vsddan](https://tria.ge/210929-ap75vsddan) +* [https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89](https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/malicious_inprocserver32_modification.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md index 1077b13f7f..74f082faaf 100644 --- a/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md @@ -1,6 +1,6 @@ --- title: "Malicious PowerShell Process - Connect To Internet With Hidden Window" -excerpt: "PowerShell" +excerpt: "PowerShell, Command and Scripting Interpreter" categories: - Endpoint last_modified_at: 2021-10-05 @@ -11,6 +11,9 @@ tags: - T1059.001 - PowerShell - Execution + - T1059 + - Command and Scripting Interpreter + - Execution - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -38,10 +41,17 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + + + + #### Search ``` @@ -85,7 +95,6 @@ You must be ingesting data that records process activity from your hosts to popu Legitimate process can have this combination of command-line options, but it's not common. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -94,6 +103,7 @@ Legitimate process can have this combination of command-line options, but it' + #### Reference * [https://regexr.com/663rr](https://regexr.com/663rr) diff --git a/docs/_posts/2021-10-05-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2021-10-05-malicious_powershell_process_-_encoded_command.md index 81cd914441..6257a189a9 100644 --- a/docs/_posts/2021-10-05-malicious_powershell_process_-_encoded_command.md +++ b/docs/_posts/2021-10-05-malicious_powershell_process_-_encoded_command.md @@ -41,11 +41,14 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion | + + #### Search ``` @@ -89,7 +92,6 @@ To successfully implement this search you need to be ingesting information on pr System administrators may use this option, but it's not common. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -98,6 +100,7 @@ System administrators may use this option, but it's not common. + #### Reference * [https://regexr.com/662ov](https://regexr.com/662ov) diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md new file mode 100644 index 0000000000..25ef5ddd09 --- /dev/null +++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md @@ -0,0 +1,122 @@ +--- +title: "Process Writing DynamicWrapperX" +excerpt: "Command and Scripting Interpreter, Component Object Model" +categories: + - Endpoint +last_modified_at: 2021-10-05 +toc: true +toc_label: "" +tags: + - Hunting + - T1059 + - Command and Scripting Interpreter + - Execution + - T1559.001 + - Component Object Model + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering it into the registry is highly suspect. Why is it needed? In most malicious instances, it will be written to disk at a non-standard location. During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. + +- **Type**: Hunting +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-05 +- **Author**: Michael Haag, Splunk +- **ID**: b0a078e4-2601-11ec-9aec-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + +| [T1559.001](https://attack.mitre.org/techniques/T1559/001/) | Component Object Model | Execution | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user +| `drop_dm_object_name(Processes)` +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="dynwrapx.dll" by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user +| `drop_dm_object_name(Filesystem)` +| fields _time process_guid file_path file_name file_create_time user dest process_name] +| stats count min(_time) as firstTime max(_time) as lastTime by dest process_name process_guid file_name file_path file_create_time user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `process_writing_dynamicwrapperx_filter` +``` + +#### Associated Analytic Story +* [Remcos](/stories/remcos) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* dest +* process_name +* process_guid +* file_name +* file_path +* file_create_time user + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default). + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll. | + + + + +#### Reference + +* [https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/](https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/) +* [https://www.script-coding.com/dynwrapx_eng.html](https://www.script-coding.com/dynwrapx_eng.html) +* [https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/](https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/) +* [https://tria.ge/210929-ap75vsddan](https://tria.ge/210929-ap75vsddan) +* [https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89](https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/process_writing_dynamicwrapperx.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md new file mode 100644 index 0000000000..2f6919746b --- /dev/null +++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md @@ -0,0 +1,112 @@ +--- +title: "Rundll32 Shimcache Flush" +excerpt: "Modify Registry" +categories: + - Endpoint +last_modified_at: 2021-10-05 +toc: true +toc_label: "" +tags: + - TTP + - T1112 + - Modify Registry + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious rundll32 commandline to clear shim cache. This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-05 +- **Author**: Teoderick Contreras, Splunk +- **ID**: a913718a-25b6-11ec-96d3-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `rundll32_shimcache_flush_filter` +``` + +#### Associated Analytic Story +* [Unusual Processes](/stories/unusual_processes) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +unknown + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | rundll32 process execute $process$ to clear shim cache in $dest$ | + + + + +#### Reference + +* [https://blueteamops.medium.com/shimcache-flush-89daff28d15e](https://blueteamops.medium.com/shimcache-flush-89daff28d15e) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/rundll32_shimcache_flush.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md new file mode 100644 index 0000000000..b6944bd10d --- /dev/null +++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md @@ -0,0 +1,118 @@ +--- +title: "Suspicious Copy on System32" +excerpt: "Rename System Utilities, Masquerading" +categories: + - Endpoint +last_modified_at: 2021-10-05 +toc: true +toc_label: "" +tags: + - TTP + - T1036.003 + - Rename System Utilities + - Defense Evasion + - T1036 + - Masquerading + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-05 +- **Author**: Teoderick Contreras, Splunk +- **ID**: ce633e56-25b2-11ec-9e76-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | + + + +| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `suspicious_copy_on_system32_filter` +``` + +#### Associated Analytic Story +* [Unusual Processes](/stories/unusual_processes) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +every user may do this event but very un-ussual. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 63.0 | 70 | 90 | execution of copy exe to copy file from $process$ in $dest$ | + + + + +#### Reference + +* [https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120](https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_copy_on_system32.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md new file mode 100644 index 0000000000..e07315ff09 --- /dev/null +++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md @@ -0,0 +1,115 @@ +--- +title: "Winhlp32 Spawning a Process" +excerpt: "Process Injection" +categories: + - Endpoint +last_modified_at: 2021-10-05 +toc: true +toc_label: "" +tags: + - TTP + - T1055 + - Process Injection + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the ".hlp" file name extension. This particular instance is related to a Remcos sample where dynwrapx.dll is added to the registry under inprocserver32, and later module loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During triage, review parallel processes to identify further suspicious behavior. Review module loads for unsuspecting unsigned modules. Capture any file modifications and analyze. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-05 +- **Author**: Michael Haag, Splunk +- **ID**: d17dae9e-2618-11ec-b9f5-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winhlp32.exe Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `winhlp32_spawning_a_process_filter` +``` + +#### Associated Analytic Story +* [Remcos](/stories/remcos) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +False positives should be limited as winhlp32.exe is typically not used with the latest flavors of Windows OS. However, filter as needed. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, and is not typical activity for this process. | + + + + +#### Reference + +* [https://www.exploit-db.com/exploits/16541](https://www.exploit-db.com/exploits/16541) +* [https://tria.ge/210929-ap75vsddan](https://tria.ge/210929-ap75vsddan) +* [https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89](https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/winhlp32_spawning_a_process.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md index ac00e595e8..895ad21f78 100644 --- a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md +++ b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md @@ -1,6 +1,6 @@ --- title: "DNS Query Length With High Standard Deviation" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" +excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Exfiltration Over Alternative Protocol" categories: - Network last_modified_at: 2021-10-06 @@ -11,6 +11,9 @@ tags: - T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol - Exfiltration + - T1048 + - Exfiltration Over Alternative Protocol + - Exfiltration - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -37,10 +40,17 @@ This search allows you to identify DNS requests and compute the standard deviati #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | + +| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | + + + + + #### Search ``` @@ -81,7 +91,6 @@ To successfully implement this search, you will need to ensure that DNS data is It's possible there can be long domain names that are legitimate. - #### RBA | Risk Score | Impact | Confidence | Message | @@ -90,6 +99,7 @@ It's possible there can be long domain names that are legitimate. + #### Reference diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md new file mode 100644 index 0000000000..747f104ad8 --- /dev/null +++ b/docs/_posts/2021-10-06-sdelete_application_execution.md @@ -0,0 +1,125 @@ +--- +title: "Sdelete Application Execution" +excerpt: "Data Destruction, File Deletion, Indicator Removal on Host" +categories: + - Endpoint +last_modified_at: 2021-10-06 +toc: true +toc_label: "" +tags: + - TTP + - T1485 + - Data Destruction + - Impact + - T1070.004 + - File Deletion + - Defense Evasion + - T1070 + - Indicator Removal on Host + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect the execution of sdelete.exe application sysinternal tools. This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user execute this application which is not a common practice. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-06 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 31702fc0-2682-11ec-85c3-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | + + +| [T1070.004](https://attack.mitre.org/techniques/T1070/004/) | File Deletion | Defense Evasion | + + + +| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_sdelete` by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `sdelete_application_execution_filter` +``` + +#### Associated Analytic Story +* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +user may execute and use this application + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | sdelete process $process_name$ executed in $dest$ | + + + + +#### Reference + +* [https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/](https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/sdelete_application_execution.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md new file mode 100644 index 0000000000..b5534a6cfa --- /dev/null +++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md @@ -0,0 +1,138 @@ +--- +title: "Wscript Or Cscript Suspicious Child Process" +excerpt: "Process Injection, Create or Modify System Process, Parent PID Spoofing, Access Token Manipulation" +categories: + - Endpoint +last_modified_at: 2021-10-06 +toc: true +toc_label: "" +tags: + - TTP + - T1055 + - Process Injection + - Defense Evasion + - Privilege Escalation + - T1543 + - Create or Modify System Process + - Persistence + - Privilege Escalation + - T1134.004 + - Parent PID Spoofing + - Defense Evasion + - Privilege Escalation + - T1134 + - Access Token Manipulation + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious spawned process by wscript or cscript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other script like powershell or create a suspended process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-06 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 1f35e1da-267b-11ec-90a9-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + + +| [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | + + +| [T1134.004](https://attack.mitre.org/techniques/T1134/004/) | Parent PID Spoofing | Defense Evasion, Privilege Escalation | + + + +| [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("cscript.exe", "wscript.exe") Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wscript_or_cscript_suspicious_child_process_filter` +``` + +#### Associated Analytic Story +* [FIN7](/stories/fin7) +* [Remcos](/stories/remcos) +* [Unusual Processes](/stories/unusual_processes) + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +user may create vbs or js script that use several tool as part of its execution. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | wscript or cscript parent process spawned $process_name$ in $dest$ | + + + + +#### Reference + +* [https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120](https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-07-etw_registry_disabled.md b/docs/_posts/2021-10-07-etw_registry_disabled.md new file mode 100644 index 0000000000..e7f5bf7607 --- /dev/null +++ b/docs/_posts/2021-10-07-etw_registry_disabled.md @@ -0,0 +1,120 @@ +--- +title: "ETW Registry Disabled" +excerpt: "Indicator Blocking, Trusted Developer Utilities Proxy Execution, Impair Defenses" +categories: + - Endpoint +last_modified_at: 2021-10-07 +toc: true +toc_label: "" +tags: + - TTP + - T1562.006 + - Indicator Blocking + - Defense Evasion + - T1127 + - Trusted Developer Utilities Proxy Execution + - Defense Evasion + - T1562 + - Impair Defenses + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-07 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 8ed523ac-276b-11ec-ac39-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1562.006](https://attack.mitre.org/techniques/T1562/006/) | Indicator Blocking | Defense Evasion | + + + +| [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion | + + + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*") Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `etw_registry_disabled_filter` +``` + +#### Associated Analytic Story +* [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Windows Privilege Escalation](/stories/windows_privilege_escalation) + + +#### How To Implement +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +#### Required field +* _time +* Registry.dest +* Registry.user +* Registry.registry_path +* Registry.registry_key_name +* Registry.registry_value_name +* Registry.registry_value_data + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +unknown + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 90.0 | 90 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | + + + + +#### Reference + +* [https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3](https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/etw_registry_disabled.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md new file mode 100644 index 0000000000..25b9dea9c0 --- /dev/null +++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md @@ -0,0 +1,114 @@ +--- +title: "Suspicious wevtutil Usage" +excerpt: "Clear Windows Event Logs, Indicator Removal on Host" +categories: + - Endpoint +last_modified_at: 2021-10-11 +toc: true +toc_label: "" +tags: + - TTP + - T1070.001 + - Clear Windows Event Logs + - Defense Evasion + - T1070 + - Indicator Removal on Host + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Actions on Objectives +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, trace or system event logs. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-11 +- **Author**: David Dorsey, Michael Haag, Splunk +- **ID**: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | +| [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | + + + +| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") (Processes.process="*System*" OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*" OR Processes.process="*trace*") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `suspicious_wevtutil_usage_filter` +``` + +#### Associated Analytic Story +* [Windows Log Manipulation](/stories/windows_log_manipulation) +* [Ransomware](/stories/ransomware) +* [Clop Ransomware](/stories/clop_ransomware) + + +#### How To Implement +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. + +#### Required field +* _time +* Processes.process +* Processes.process_name +* Processes.parent_process_name +* Processes.dest +* Processes.user + + +#### Kill Chain Phase +* Actions on Objectives + + +#### Known False Positives +The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 28.0 | 40 | 70 | Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ | + + + + +#### Reference + +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_wevtutil_usage.yml) \| *version*: **4** \ No newline at end of file diff --git a/docs/_posts/2021-10-13-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-10-13-dllhost_with_no_command_line_arguments_with_network.md new file mode 100644 index 0000000000..3c9803f410 --- /dev/null +++ b/docs/_posts/2021-10-13-dllhost_with_no_command_line_arguments_with_network.md @@ -0,0 +1,115 @@ +--- +title: "DLLHost with no Command Line Arguments with Network" +excerpt: "Process Injection" +categories: + - Endpoint +last_modified_at: 2021-10-13 +toc: true +toc_label: "" +tags: + - TTP + - T1055 + - Process Injection + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies DLLHost.exe with no command line arguments with a network connection. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-13 +- **Author**: Michael Haag, Splunk +- **ID**: f1c07594-a141-11eb-8407-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(dllhost\.exe.{0,4}$)" +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port +| `drop_dm_object_name(Ports)` +| rename dest as connection_to_CNC] +| table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port +| `dllhost_with_no_command_line_arguments_with_network_filter` +``` + +#### Associated Analytic Story +* [Cobalt Strike](/stories/cobalt_strike) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. + +#### Required field +* _time +* EventID +* process_name +* process_id +* parent_process_name +* dest_port +* process_path + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +Although unlikely, some legitimate third party applications may use a moved copy of dllhost, triggering a false positive. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. | + + + + +#### Reference + +* [https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile](https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile) +* [https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/](https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2021-10-13-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-10-13-rundll32_with_no_command_line_arguments_with_network.md new file mode 100644 index 0000000000..b1781f7900 --- /dev/null +++ b/docs/_posts/2021-10-13-rundll32_with_no_command_line_arguments_with_network.md @@ -0,0 +1,137 @@ +--- +title: "Rundll32 with no Command Line Arguments with Network" +excerpt: "Signed Binary Proxy Execution, Rundll32" +categories: + - Endpoint +last_modified_at: 2021-10-13 +toc: true +toc_label: "" +tags: + - TTP + - T1218 + - Signed Binary Proxy Execution + - Defense Evasion + - T1218.011 + - Rundll32 + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2021-34527 + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-13 +- **Author**: Michael Haag, Splunk +- **ID**: 35307032-a12d-11eb-835f-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + + +| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(rundll32\.exe.{0,4}$)" +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port +| `drop_dm_object_name(Ports)` +| rename dest as connection_to_CNC] +| table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port +| `rundll32_with_no_command_line_arguments_with_network_filter` +``` + +#### Associated Analytic Story +* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) +* [Cobalt Strike](/stories/cobalt_strike) +* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 70.0 | 70 | 100 | A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ | + + + +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | + + + +#### Reference + +* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md) +* [https://lolbas-project.github.io/lolbas/Binaries/Rundll32](https://lolbas-project.github.io/lolbas/Binaries/Rundll32) +* [https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/](https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_posts/2021-10-13-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2021-10-13-searchprotocolhost_with_no_command_line_with_network.md new file mode 100644 index 0000000000..d5551a6cb9 --- /dev/null +++ b/docs/_posts/2021-10-13-searchprotocolhost_with_no_command_line_with_network.md @@ -0,0 +1,113 @@ +--- +title: "SearchProtocolHost with no Command Line with Network" +excerpt: "Process Injection" +categories: + - Endpoint +last_modified_at: 2021-10-13 +toc: true +toc_label: "" +tags: + - TTP + - T1055 + - Process Injection + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-13 +- **Author**: Michael Haag, Splunk +- **ID**: b690df8c-a145-11eb-a38b-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------- | + +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + + + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(searchprotocolhost\.exe.{0,4}$)" +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port +| `drop_dm_object_name(Ports)` +| rename dest as connection_to_CNC] +| table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port +| `searchprotocolhost_with_no_command_line_with_network_filter` +``` + +#### Associated Analytic Story +* [Cobalt Strike](/stories/cobalt_strike) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. + +#### Required field +* _time +* process_name +* process_id +* parent_process_name +* dest_port +* process_path + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +Limited false positives may be present in small environments. Tuning may be required based on parent process. + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 70.0 | 70 | 100 | A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ | + + + + +#### Reference + +* [https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc](https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2021-2-1-first_time_seen_command_line_argument.md b/docs/_posts/2021-2-1-first_time_seen_command_line_argument.md index 358b672ba6..51544841da 100644 --- a/docs/_posts/2021-2-1-first_time_seen_command_line_argument.md +++ b/docs/_posts/2021-2-1-first_time_seen_command_line_argument.md @@ -40,13 +40,22 @@ This search looks for command-line arguments that use a `/c` parameter to execut #### ATT&CK | ID | Technique | Tactic | -| ----------- | ----------- | -------------- | +| ----------- | ----------- |--------------- | + | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + + + | [T1117](https://attack.mitre.org/techniques/T1117/) | Regsvr32 | | + + + | [T1202](https://attack.mitre.org/techniques/T1202/) | Indirect Command Execution | Defense Evasion | + + #### Search ``` @@ -88,7 +97,6 @@ You must be populating the endpoint data model for SSA and specifically the proc Legitimate programs can also use command-line arguments to execute. Please verify the command-line arguments to check what command/program is being executed. We recommend customizing the `first_time_seen_cmd_line_filter` macro to exclude legitimate parent_process_name - #### RBA | Risk Score | Impact | Confidence | Message | @@ -97,6 +105,7 @@ Legitimate programs can also use command-line arguments to execute. Please verif + #### Reference diff --git a/docs/_stories/active_directory_discovery.md b/docs/_stories/active_directory_discovery.md index ca8a94e001..7dc8283b01 100644 --- a/docs/_stories/active_directory_discovery.md +++ b/docs/_stories/active_directory_discovery.md @@ -31,70 +31,70 @@ Once an attacker obtains an initial foothold in an Active Directory environment, | Name | Technique | Type | | ----------- | ----------- |--------------| -| [AdsiSearcher Account Discovery](/endpoint/adsisearcher_account_discovery/) | [Domain Account](/tags/#domain-account) | TTP | +| [AdsiSearcher Account Discovery](/endpoint/adsisearcher_account_discovery/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | | [DSQuery Domain Discovery](/endpoint/dsquery_domain_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | -| [Domain Account Discovery With Net App](/endpoint/domain_account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | TTP | -| [Domain Account Discovery with Dsquery](/endpoint/domain_account_discovery_with_dsquery/) | [Domain Account](/tags/#domain-account) | Hunting | -| [Domain Account Discovery with Wmic](/endpoint/domain_account_discovery_with_wmic/) | [Domain Account](/tags/#domain-account) | TTP | +| [Domain Account Discovery With Net App](/endpoint/domain_account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | +| [Domain Account Discovery with Dsquery](/endpoint/domain_account_discovery_with_dsquery/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | Hunting | +| [Domain Account Discovery with Wmic](/endpoint/domain_account_discovery_with_wmic/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | | [Domain Controller Discovery with Nltest](/endpoint/domain_controller_discovery_with_nltest/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | | [Domain Controller Discovery with Wmic](/endpoint/domain_controller_discovery_with_wmic/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | -| [Domain Group Discovery With Dsquery](/endpoint/domain_group_discovery_with_dsquery/) | [Domain Groups](/tags/#domain-groups) | Hunting | -| [Domain Group Discovery With Net](/endpoint/domain_group_discovery_with_net/) | [Domain Groups](/tags/#domain-groups) | Hunting | -| [Domain Group Discovery With Wmic](/endpoint/domain_group_discovery_with_wmic/) | [Domain Groups](/tags/#domain-groups) | Hunting | -| [Domain Group Discovery with Adsisearcher](/endpoint/domain_group_discovery_with_adsisearcher/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [Elevated Group Discovery With Net](/endpoint/elevated_group_discovery_with_net/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [Elevated Group Discovery With Wmic](/endpoint/elevated_group_discovery_with_wmic/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [Elevated Group Discovery with PowerView](/endpoint/elevated_group_discovery_with_powerview/) | [Domain Groups](/tags/#domain-groups) | Hunting | +| [Domain Group Discovery With Dsquery](/endpoint/domain_group_discovery_with_dsquery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | +| [Domain Group Discovery With Net](/endpoint/domain_group_discovery_with_net/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | +| [Domain Group Discovery With Wmic](/endpoint/domain_group_discovery_with_wmic/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | +| [Domain Group Discovery with Adsisearcher](/endpoint/domain_group_discovery_with_adsisearcher/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [Elevated Group Discovery With Net](/endpoint/elevated_group_discovery_with_net/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [Elevated Group Discovery With Wmic](/endpoint/elevated_group_discovery_with_wmic/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [Elevated Group Discovery with PowerView](/endpoint/elevated_group_discovery_with_powerview/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | | [Get ADDefaultDomainPasswordPolicy with Powershell](/endpoint/get_addefaultdomainpasswordpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | Hunting | | [Get ADDefaultDomainPasswordPolicy with Powershell Script Block](/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | Hunting | -| [Get ADUser with PowerShell](/endpoint/get_aduser_with_powershell/) | [Domain Account](/tags/#domain-account) | Hunting | -| [Get ADUser with PowerShell Script Block](/endpoint/get_aduser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | Hunting | +| [Get ADUser with PowerShell](/endpoint/get_aduser_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | Hunting | +| [Get ADUser with PowerShell Script Block](/endpoint/get_aduser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | Hunting | | [Get ADUserResultantPasswordPolicy with Powershell](/endpoint/get_aduserresultantpasswordpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | | [Get ADUserResultantPasswordPolicy with Powershell Script Block](/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | | [Get DomainPolicy with Powershell](/endpoint/get_domainpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | | [Get DomainPolicy with Powershell Script Block](/endpoint/get_domainpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | -| [Get DomainUser with PowerShell](/endpoint/get_domainuser_with_powershell/) | [Domain Account](/tags/#domain-account) | TTP | -| [Get DomainUser with PowerShell Script Block](/endpoint/get_domainuser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | TTP | -| [Get WMIObject Group Discovery](/endpoint/get_wmiobject_group_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | -| [Get WMIObject Group Discovery with Script Block Logging](/endpoint/get_wmiobject_group_discovery_with_script_block_logging/) | [Local Groups](/tags/#local-groups) | Hunting | +| [Get DomainUser with PowerShell](/endpoint/get_domainuser_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | +| [Get DomainUser with PowerShell Script Block](/endpoint/get_domainuser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | +| [Get WMIObject Group Discovery](/endpoint/get_wmiobject_group_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | +| [Get WMIObject Group Discovery with Script Block Logging](/endpoint/get_wmiobject_group_discovery_with_script_block_logging/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | | [Get-DomainTrust with PowerShell](/endpoint/get-domaintrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [Get-DomainTrust with PowerShell Script Block](/endpoint/get-domaintrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [Get-ForestTrust with PowerShell](/endpoint/get-foresttrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [GetAdComputer with PowerShell](/endpoint/getadcomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | | [GetAdComputer with PowerShell Script Block](/endpoint/getadcomputer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | -| [GetAdGroup with PowerShell](/endpoint/getadgroup_with_powershell/) | [Domain Groups](/tags/#domain-groups) | Hunting | -| [GetAdGroup with PowerShell Script Block](/endpoint/getadgroup_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | Hunting | +| [GetAdGroup with PowerShell](/endpoint/getadgroup_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | +| [GetAdGroup with PowerShell Script Block](/endpoint/getadgroup_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | Hunting | | [GetCurrent User with PowerShell](/endpoint/getcurrent_user_with_powershell/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | | [GetCurrent User with PowerShell Script Block](/endpoint/getcurrent_user_with_powershell_script_block/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | | [GetDomainComputer with PowerShell](/endpoint/getdomaincomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | | [GetDomainComputer with PowerShell Script Block](/endpoint/getdomaincomputer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | | [GetDomainController with PowerShell](/endpoint/getdomaincontroller_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | | [GetDomainController with PowerShell Script Block](/endpoint/getdomaincontroller_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | -| [GetDomainGroup with PowerShell](/endpoint/getdomaingroup_with_powershell/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [GetDomainGroup with PowerShell Script Block](/endpoint/getdomaingroup_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [GetLocalUser with PowerShell](/endpoint/getlocaluser_with_powershell/) | [Local Account](/tags/#local-account) | Hunting | -| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Local Account](/tags/#local-account) | Hunting | +| [GetDomainGroup with PowerShell](/endpoint/getdomaingroup_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [GetDomainGroup with PowerShell Script Block](/endpoint/getdomaingroup_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [GetLocalUser with PowerShell](/endpoint/getlocaluser_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | +| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | | [GetNetTcpconnection with PowerShell](/endpoint/getnettcpconnection_with_powershell/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | | [GetNetTcpconnection with PowerShell Script Block](/endpoint/getnettcpconnection_with_powershell_script_block/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | -| [GetWmiObject DS User with PowerShell](/endpoint/getwmiobject_ds_user_with_powershell/) | [Domain Account](/tags/#domain-account) | TTP | -| [GetWmiObject DS User with PowerShell Script Block](/endpoint/getwmiobject_ds_user_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | TTP | +| [GetWmiObject DS User with PowerShell](/endpoint/getwmiobject_ds_user_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | +| [GetWmiObject DS User with PowerShell Script Block](/endpoint/getwmiobject_ds_user_with_powershell_script_block/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | | [GetWmiObject Ds Computer with PowerShell](/endpoint/getwmiobject_ds_computer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | | [GetWmiObject Ds Computer with PowerShell Script Block](/endpoint/getwmiobject_ds_computer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | -| [GetWmiObject Ds Group with PowerShell](/endpoint/getwmiobject_ds_group_with_powershell/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [GetWmiObject Ds Group with PowerShell Script Block](/endpoint/getwmiobject_ds_group_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | TTP | -| [GetWmiObject User Account with PowerShell](/endpoint/getwmiobject_user_account_with_powershell/) | [Local Account](/tags/#local-account) | Hunting | -| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Local Account](/tags/#local-account) | Hunting | -| [Local Account Discovery With Wmic](/endpoint/local_account_discovery_with_wmic/) | [Local Account](/tags/#local-account) | Hunting | -| [Local Account Discovery with Net](/endpoint/local_account_discovery_with_net/) | [Local Account](/tags/#local-account) | Hunting | +| [GetWmiObject Ds Group with PowerShell](/endpoint/getwmiobject_ds_group_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [GetWmiObject Ds Group with PowerShell Script Block](/endpoint/getwmiobject_ds_group_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | TTP | +| [GetWmiObject User Account with PowerShell](/endpoint/getwmiobject_user_account_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | +| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | +| [Local Account Discovery With Wmic](/endpoint/local_account_discovery_with_wmic/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | +| [Local Account Discovery with Net](/endpoint/local_account_discovery_with_net/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | Hunting | | [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | -| [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | +| [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | | [Network Connection Discovery With Arp](/endpoint/network_connection_discovery_with_arp/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | | [Network Connection Discovery With Net](/endpoint/network_connection_discovery_with_net/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | | [Network Connection Discovery With Netstat](/endpoint/network_connection_discovery_with_netstat/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | | [Password Policy Discovery with Net](/endpoint/password_policy_discovery_with_net/) | [Password Policy Discovery](/tags/#password-policy-discovery) | Hunting | -| [PowerShell Get LocalGroup Discovery](/endpoint/powershell_get_localgroup_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | -| [Powershell Get LocalGroup Discovery with Script Block Logging](/endpoint/powershell_get_localgroup_discovery_with_script_block_logging/) | [Local Groups](/tags/#local-groups) | Hunting | +| [PowerShell Get LocalGroup Discovery](/endpoint/powershell_get_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | +| [Powershell Get LocalGroup Discovery with Script Block Logging](/endpoint/powershell_get_localgroup_discovery_with_script_block_logging/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | | [Remote System Discovery with Adsisearcher](/endpoint/remote_system_discovery_with_adsisearcher/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | | [Remote System Discovery with Dsquery](/endpoint/remote_system_discovery_with_dsquery/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | | [Remote System Discovery with Net](/endpoint/remote_system_discovery_with_net/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | @@ -103,7 +103,7 @@ Once an attacker obtains an initial foothold in an Active Directory environment, | [System User Discovery With Whoami](/endpoint/system_user_discovery_with_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | | [User Discovery With Env Vars PowerShell](/endpoint/user_discovery_with_env_vars_powershell/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | | [User Discovery With Env Vars PowerShell Script Block](/endpoint/user_discovery_with_env_vars_powershell_script_block/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | -| [Wmic Group Discovery](/endpoint/wmic_group_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | +| [Wmic Group Discovery](/endpoint/wmic_group_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | #### Reference diff --git a/docs/_stories/active_directory_password_spraying.md b/docs/_stories/active_directory_password_spraying.md index ba1d5d7643..a4be2498cf 100644 --- a/docs/_stories/active_directory_password_spraying.md +++ b/docs/_stories/active_directory_password_spraying.md @@ -32,14 +32,14 @@ Specifically, this Analytic Story is focused on detecting possible Password Spra | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Users Attempting To Authenticate Using Explicit Credentials](/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying) | Anomaly | -| [Multiple Users Remotely Failing To Authenticate From Host](/endpoint/multiple_users_remotely_failing_to_authenticate_from_host/) | [Password Spraying](/tags/#password-spraying) | Anomaly | +| [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Users Attempting To Authenticate Using Explicit Credentials](/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | +| [Multiple Users Remotely Failing To Authenticate From Host](/endpoint/multiple_users_remotely_failing_to_authenticate_from_host/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | #### Reference diff --git a/docs/_stories/aws_iam_privilege_escalation.md b/docs/_stories/aws_iam_privilege_escalation.md index 8fb7923022..941fa18846 100644 --- a/docs/_stories/aws_iam_privilege_escalation.md +++ b/docs/_stories/aws_iam_privilege_escalation.md @@ -31,15 +31,15 @@ However, if these IAM policies are misconfigured and have specific combinations | Name | Technique | Type | | ----------- | ----------- |--------------| -| [AWS Create Policy Version to allow all resources](/cloud/aws_create_policy_version_to_allow_all_resources/) | [Cloud Accounts](/tags/#cloud-accounts) | TTP | -| [AWS CreateAccessKey](/cloud/aws_createaccesskey/) | [Cloud Account](/tags/#cloud-account) | Hunting | -| [AWS CreateLoginProfile](/cloud/aws_createloginprofile/) | [Cloud Account](/tags/#cloud-account) | TTP | +| [AWS Create Policy Version to allow all resources](/cloud/aws_create_policy_version_to_allow_all_resources/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | TTP | +| [AWS CreateAccessKey](/cloud/aws_createaccesskey/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | Hunting | +| [AWS CreateLoginProfile](/cloud/aws_createloginprofile/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | | [AWS IAM Assume Role Policy Brute Force](/cloud/aws_iam_assume_role_policy_brute_force/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force) | TTP | | [AWS IAM Delete Policy](/cloud/aws_iam_delete_policy/) | [Account Manipulation](/tags/#account-manipulation) | Hunting | | [AWS IAM Failure Group Deletion](/cloud/aws_iam_failure_group_deletion/) | [Account Manipulation](/tags/#account-manipulation) | Anomaly | -| [AWS IAM Successful Group Deletion](/cloud/aws_iam_successful_group_deletion/) | [Cloud Groups](/tags/#cloud-groups), [Account Manipulation](/tags/#account-manipulation) | Hunting | -| [AWS SetDefaultPolicyVersion](/cloud/aws_setdefaultpolicyversion/) | [Cloud Accounts](/tags/#cloud-accounts) | TTP | -| [AWS UpdateLoginProfile](/cloud/aws_updateloginprofile/) | [Cloud Account](/tags/#cloud-account) | TTP | +| [AWS IAM Successful Group Deletion](/cloud/aws_iam_successful_group_deletion/) | [Cloud Groups](/tags/#cloud-groups), [Account Manipulation](/tags/#account-manipulation), [Permission Groups Discovery](/tags/#permission-groups-discovery) | Hunting | +| [AWS SetDefaultPolicyVersion](/cloud/aws_setdefaultpolicyversion/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | TTP | +| [AWS UpdateLoginProfile](/cloud/aws_updateloginprofile/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | #### Reference diff --git a/docs/_stories/aws_network_acl_activity.md b/docs/_stories/aws_network_acl_activity.md index ccbfb85386..359fbc3f4e 100644 --- a/docs/_stories/aws_network_acl_activity.md +++ b/docs/_stories/aws_network_acl_activity.md @@ -30,8 +30,8 @@ AWS CloudTrail is an AWS service that helps you enable governance, compliance, a | Name | Technique | Type | | ----------- | ----------- |--------------| -| [AWS Network Access Control List Created with All Open Ports](/cloud/aws_network_access_control_list_created_with_all_open_ports/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | -| [AWS Network Access Control List Deleted](/cloud/aws_network_access_control_list_deleted/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | Anomaly | +| [AWS Network Access Control List Created with All Open Ports](/cloud/aws_network_access_control_list_created_with_all_open_ports/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [AWS Network Access Control List Deleted](/cloud/aws_network_access_control_list_deleted/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | Anomaly | | [Detect Spike in blocked Outbound Traffic from your AWS](/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws/) | | Anomaly | #### Reference diff --git a/docs/_stories/blackmatter_ransomware.md b/docs/_stories/blackmatter_ransomware.md index ad3881edd0..c6dc072cdb 100644 --- a/docs/_stories/blackmatter_ransomware.md +++ b/docs/_stories/blackmatter_ransomware.md @@ -30,8 +30,8 @@ BlackMatter ransomware campaigns targeting healthcare and other vertical sectors | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Add DefaultUser And Password In Registry](/endpoint/add_defaultuser_and_password_in_registry/) | [Credentials in Registry](/tags/#credentials-in-registry) | Anomaly | -| [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry) | TTP | +| [Add DefaultUser And Password In Registry](/endpoint/add_defaultuser_and_password_in_registry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | Anomaly | +| [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP | | [Bcdedit Command Back To Normal Mode Boot](/endpoint/bcdedit_command_back_to_normal_mode_boot/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Change To Safe Mode With Network Config](/endpoint/change_to_safe_mode_with_network_config/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Known Services Killed by Ransomware](/endpoint/known_services_killed_by_ransomware/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | diff --git a/docs/_stories/clop_ransomware.md b/docs/_stories/clop_ransomware.md index dafc23a2a3..4cfe02190d 100644 --- a/docs/_stories/clop_ransomware.md +++ b/docs/_stories/clop_ransomware.md @@ -34,7 +34,7 @@ Clop ransomware campaigns targeting healthcare and other vertical sectors, invol | [Clop Ransomware Known Service Name](/endpoint/clop_ransomware_known_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting | -| [Create Service In Suspicious File Path](/endpoint/create_service_in_suspicious_file_path/) | [Service Execution](/tags/#service-execution) | TTP | +| [Create Service In Suspicious File Path](/endpoint/create_service_in_suspicious_file_path/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | TTP | | [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly | | [High Process Termination Frequency](/endpoint/high_process_termination_frequency/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly | @@ -42,10 +42,10 @@ Clop ransomware campaigns targeting healthcare and other vertical sectors, invol | [Ransomware Notes bulk creation](/endpoint/ransomware_notes_bulk_creation/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly | | [Resize ShadowStorage volume](/endpoint/resize_shadowstorage_volume/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Resize Shadowstorage Volume](/endpoint/resize_shadowstorage_volume/) | [Service Stop](/tags/#service-stop) | TTP | -| [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [WevtUtil Usage To Clear Logs](/endpoint/wevtutil_usage_to_clear_logs/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | +| [WevtUtil Usage To Clear Logs](/endpoint/wevtutil_usage_to_clear_logs/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | #### Reference diff --git a/docs/_stories/cloud_cryptomining.md b/docs/_stories/cloud_cryptomining.md index 07394ba9a3..5b3567ce17 100644 --- a/docs/_stories/cloud_cryptomining.md +++ b/docs/_stories/cloud_cryptomining.md @@ -34,8 +34,8 @@ This Analytic Story is focused on detecting suspicious new instances in your clo | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | -| [Cloud Compute Instance Created By Previously Unseen User](/cloud/cloud_compute_instance_created_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Cloud Compute Instance Created By Previously Unseen User](/cloud/cloud_compute_instance_created_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | | [Cloud Compute Instance Created In Previously Unused Region](/cloud/cloud_compute_instance_created_in_previously_unused_region/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Anomaly | | [Cloud Compute Instance Created With Previously Unseen Image](/cloud/cloud_compute_instance_created_with_previously_unseen_image/) | | Anomaly | | [Cloud Compute Instance Created With Previously Unseen Instance Type](/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type/) | | Anomaly | diff --git a/docs/_stories/cloud_federated_credential_abuse.md b/docs/_stories/cloud_federated_credential_abuse.md index a9011cd822..f9f7b133cd 100644 --- a/docs/_stories/cloud_federated_credential_abuse.md +++ b/docs/_stories/cloud_federated_credential_abuse.md @@ -34,13 +34,13 @@ This story is composed of detection searches based on endpoint that addresses th | [AWS SAML Access by Provider User and Principal](/cloud/aws_saml_access_by_provider_user_and_principal/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | | [AWS SAML Update identity provider](/cloud/aws_saml_update_identity_provider/) | [Valid Accounts](/tags/#valid-accounts) | TTP | | [Certutil exe certificate extraction](/endpoint/certutil_exe_certificate_extraction/) | | TTP | -| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory) | TTP | +| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Detect Rare Executables](/endpoint/detect_rare_executables/) | | Anomaly | -| [O365 Add App Role Assignment Grant User](/cloud/o365_add_app_role_assignment_grant_user/) | [Cloud Account](/tags/#cloud-account) | TTP | -| [O365 Added Service Principal](/cloud/o365_added_service_principal/) | [Cloud Account](/tags/#cloud-account) | TTP | +| [O365 Add App Role Assignment Grant User](/cloud/o365_add_app_role_assignment_grant_user/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | +| [O365 Added Service Principal](/cloud/o365_added_service_principal/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | | [O365 Excessive SSO logon errors](/cloud/o365_excessive_sso_logon_errors/) | [Modify Authentication Process](/tags/#modify-authentication-process) | Anomaly | -| [O365 New Federated Domain Added](/cloud/o365_new_federated_domain_added/) | [Cloud Account](/tags/#cloud-account) | TTP | -| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | TTP | +| [O365 New Federated Domain Added](/cloud/o365_new_federated_domain_added/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | +| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | #### Reference diff --git a/docs/_stories/cobalt_strike.md b/docs/_stories/cobalt_strike.md index cd97df804b..d3fb679f4f 100644 --- a/docs/_stories/cobalt_strike.md +++ b/docs/_stories/cobalt_strike.md @@ -39,23 +39,23 @@ While investigating a detection related to this Analytic Story, keep in mind the | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility) | Anomaly | -| [CMD Echo Pipe - Escalation](/endpoint/cmd_echo_pipe_-_escalation/) | [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service) | TTP | +| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Anomaly | +| [CMD Echo Pipe - Escalation](/endpoint/cmd_echo_pipe_-_escalation/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection) | TTP | | [DLLHost with no Command Line Arguments with Network](/endpoint/dllhost_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | TTP | -| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Regsvr32](/tags/#regsvr32) | TTP | +| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | TTP | | [GPUpdate with no Command Line Arguments with Network](/endpoint/gpupdate_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | TTP | -| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [SearchProtocolHost with no Command Line with Network](/endpoint/searchprotocolhost_with_no_command_line_with_network/) | [Process Injection](/tags/#process-injection) | TTP | | [Services Escalate Exe](/endpoint/services_escalate_exe/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [Suspicious DLLHost no Command Line Arguments](/endpoint/suspicious_dllhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | | [Suspicious GPUpdate no Command Line Arguments](/endpoint/suspicious_gpupdate_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | -| [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | -| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Rundll32](/tags/#rundll32) | TTP | -| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP | +| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Suspicious SearchProtocolHost no Command Line Arguments](/endpoint/suspicious_searchprotocolhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | -| [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | -| [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP | #### Reference diff --git a/docs/_stories/collection_and_staging.md b/docs/_stories/collection_and_staging.md index 0f2a54e40c..21dfeff9ce 100644 --- a/docs/_stories/collection_and_staging.md +++ b/docs/_stories/collection_and_staging.md @@ -33,11 +33,11 @@ Use the searches to detect and monitor suspicious behavior related to these acti | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Renamed 7-Zip](/endpoint/detect_renamed_7-zip/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | -| [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | -| [Email files written outside of the Outlook directory](/application/email_files_written_outside_of_the_outlook_directory/) | [Local Email Collection](/tags/#local-email-collection) | TTP | -| [Email servers sending high volume traffic to hosts](/application/email_servers_sending_high_volume_traffic_to_hosts/) | [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | -| [Hosts receiving high volume of network traffic from email server](/network/hosts_receiving_high_volume_of_network_traffic_from_email_server/) | [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | +| [Detect Renamed 7-Zip](/endpoint/detect_renamed_7-zip/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting | +| [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting | +| [Email files written outside of the Outlook directory](/application/email_files_written_outside_of_the_outlook_directory/) | [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection) | TTP | +| [Email servers sending high volume traffic to hosts](/application/email_servers_sending_high_volume_traffic_to_hosts/) | [Email Collection](/tags/#email-collection), [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | +| [Hosts receiving high volume of network traffic from email server](/network/hosts_receiving_high_volume_of_network_traffic_from_email_server/) | [Remote Email Collection](/tags/#remote-email-collection), [Email Collection](/tags/#email-collection) | Anomaly | | [Suspicious writes to windows Recycle Bin](/endpoint/suspicious_writes_to_windows_recycle_bin/) | [Masquerading](/tags/#masquerading) | TTP | #### Reference diff --git a/docs/_stories/command_and_control.md b/docs/_stories/command_and_control.md index a4eaa25b5b..1a8da8e6b8 100644 --- a/docs/_stories/command_and_control.md +++ b/docs/_stories/command_and_control.md @@ -34,18 +34,18 @@ Because this communication is so critical for an adversary, they often use techn | Name | Technique | Type | | ----------- | ----------- |--------------| | [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | -| [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns) | Anomaly | -| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | +| [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol) | Anomaly | +| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | | [Detect Large Outbound ICMP Packets](/network/detect_large_outbound_icmp_packets/) | [Non-Application Layer Protocol](/tags/#non-application-layer-protocol) | TTP | | [Detect Spike in blocked Outbound Traffic from your AWS](/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws/) | | Anomaly | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | TTP | -| [Excessive DNS Failures](/network/excessive_dns_failures/) | [DNS](/tags/#dns) | Anomaly | +| [Excessive DNS Failures](/network/excessive_dns_failures/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol) | Anomaly | | [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | -| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | TTP | -| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | TTP | +| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | +| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | | [Prohibited Network Traffic Allowed](/network/prohibited_network_traffic_allowed/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | -| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | -| [TOR Traffic](/network/tor_traffic/) | [Web Protocols](/tags/#web-protocols) | TTP | +| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | +| [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | TTP | #### Reference diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md index 7fcfc99376..56ce77ddd8 100644 --- a/docs/_stories/credential_dumping.md +++ b/docs/_stories/credential_dumping.md @@ -32,18 +32,18 @@ The detection searches in this Analytic Story monitor access to the Local Securi | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory) | TTP | +| [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Applying Stolen Credentials via Mimikatz modules](/endpoint/applying_stolen_credentials_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | | [Applying Stolen Credentials via PowerSploit modules](/endpoint/applying_stolen_credentials_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | | [Assessment of Credential Strength via DSInternals modules](/endpoint/assessment_of_credential_strength_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | TTP | | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager) | TTP | -| [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds) | TTP | -| [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds) | TTP | -| [Creation of lsass Dump with Taskmgr](/endpoint/creation_of_lsass_dump_with_taskmgr/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Credential Dumping via Copy Command from Shadow Copy](/endpoint/credential_dumping_via_copy_command_from_shadow_copy/) | [NTDS](/tags/#ntds) | TTP | -| [Credential Dumping via Symlink to Shadow Copy](/endpoint/credential_dumping_via_symlink_to_shadow_copy/) | [NTDS](/tags/#ntds) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Creation of lsass Dump with Taskmgr](/endpoint/creation_of_lsass_dump_with_taskmgr/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Dumping via Copy Command from Shadow Copy](/endpoint/credential_dumping_via_copy_command_from_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Dumping via Symlink to Shadow Copy](/endpoint/credential_dumping_via_symlink_to_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of FGDump and CacheDump with s option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of FGDump and CacheDump with v option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of Lazagne command line options](/endpoint/credential_extraction_indicative_of_lazagne_command_line_options/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | TTP | @@ -54,19 +54,20 @@ The detection searches in this Analytic Story monitor access to the Local Securi | [Credential Extraction native Microsoft debuggers peek into the kernel](/endpoint/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction native Microsoft debuggers via z command line option](/endpoint/credential_extraction_native_microsoft_debuggers_via_z_command_line_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals](/endpoint/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Detect Copy of ShadowCopy with Script Block Logging](/endpoint/detect_copy_of_shadowcopy_with_script_block_logging/) | [Security Account Manager](/tags/#security-account-manager) | TTP | -| [Detect Credential Dumping through LSASS access](/endpoint/detect_credential_dumping_through_lsass_access/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Detect Dump LSASS Memory using comsvcs](/endpoint/detect_dump_lsass_memory_using_comsvcs/) | [NTDS](/tags/#ntds) | TTP | -| [Detect Kerberoasting](/endpoint/detect_kerberoasting/) | [Kerberoasting](/tags/#kerberoasting) | TTP | -| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Dump LSASS via procdump](/endpoint/dump_lsass_via_procdump/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager) | Hunting | -| [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager) | TTP | -| [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds) | TTP | -| [SAM Database File Access Attempt](/endpoint/sam_database_file_access_attempt/) | [Security Account Manager](/tags/#security-account-manager) | Hunting | -| [SecretDumps Offline NTDS Dumping Tool](/endpoint/secretdumps_offline_ntds_dumping_tool/) | [NTDS](/tags/#ntds) | TTP | -| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [PowerShell](/tags/#powershell) | TTP | +| [Detect Copy of ShadowCopy with Script Block Logging](/endpoint/detect_copy_of_shadowcopy_with_script_block_logging/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Detect Credential Dumping through LSASS access](/endpoint/detect_credential_dumping_through_lsass_access/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Detect Dump LSASS Memory using comsvcs](/endpoint/detect_dump_lsass_memory_using_comsvcs/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Detect Kerberoasting](/endpoint/detect_kerberoasting/) | [Kerberoasting](/tags/#kerberoasting), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | +| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Dump LSASS via procdump](/endpoint/dump_lsass_via_procdump/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Enable WDigest UseLogonCredential Registry](/endpoint/enable_wdigest_uselogoncredential_registry/) | [Modify Registry](/tags/#modify-registry), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | Hunting | +| [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [SAM Database File Access Attempt](/endpoint/sam_database_file_access_attempt/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | Hunting | +| [SecretDumps Offline NTDS Dumping Tool](/endpoint/secretdumps_offline_ntds_dumping_tool/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | #### Reference diff --git a/docs/_stories/darkside_ransomware.md b/docs/_stories/darkside_ransomware.md index 230791d807..95ab2cb837 100644 --- a/docs/_stories/darkside_ransomware.md +++ b/docs/_stories/darkside_ransomware.md @@ -30,22 +30,22 @@ This story addresses Darkside ransomware. This ransomware payload has many simil | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [BITSAdmin Download File](/endpoint/bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | -| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [CMSTP](/tags/#cmstp) | TTP | +| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP | | [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [CertUtil Download With VerifyCtl and Split Arguments](/endpoint/certutil_download_with_verifyctl_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection) | TTP | | [Delete ShadowCopy With PowerShell](/endpoint/delete_shadowcopy_with_powershell/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | -| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | | [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP | -| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [Service Execution](/tags/#service-execution) | Hunting | +| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting | | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Hunting | -| [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Ransomware Notes bulk creation](/endpoint/ransomware_notes_bulk_creation/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly | -| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | #### Reference diff --git a/docs/_stories/data_exfiltration.md b/docs/_stories/data_exfiltration.md index 3a55d9d6e4..501a0b2c96 100644 --- a/docs/_stories/data_exfiltration.md +++ b/docs/_stories/data_exfiltration.md @@ -35,12 +35,12 @@ Exfiltration comes in many flavors. Adversaries can collect data over encrypted | [Detect SNICat SNI Exfiltration](/network/detect_snicat_sni_exfiltration/) | [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel) | TTP | | [Detect shared ec2 snapshot](/cloud/detect_shared_ec2_snapshot/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | TTP | | [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | -| [Mailsniper Invoke functions](/endpoint/mailsniper_invoke_functions/) | [Local Email Collection](/tags/#local-email-collection) | TTP | -| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | TTP | +| [Mailsniper Invoke functions](/endpoint/mailsniper_invoke_functions/) | [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection) | TTP | +| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | | [O365 PST export alert](/cloud/o365_pst_export_alert/) | [Email Collection](/tags/#email-collection) | TTP | -| [O365 Suspicious Admin Email Forwarding](/cloud/o365_suspicious_admin_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | Anomaly | -| [O365 Suspicious User Email Forwarding](/cloud/o365_suspicious_user_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | Anomaly | -| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | TTP | +| [O365 Suspicious Admin Email Forwarding](/cloud/o365_suspicious_admin_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule), [Email Collection](/tags/#email-collection) | Anomaly | +| [O365 Suspicious User Email Forwarding](/cloud/o365_suspicious_user_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule), [Email Collection](/tags/#email-collection) | Anomaly | +| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | #### Reference diff --git a/docs/_stories/detect_zerologon_attack.md b/docs/_stories/detect_zerologon_attack.md index 82dfa2f05f..e62dfd6a5b 100644 --- a/docs/_stories/detect_zerologon_attack.md +++ b/docs/_stories/detect_zerologon_attack.md @@ -30,8 +30,8 @@ This attack is a privilege escalation technique, where attacker targets a Netlog | Name | Technique | Type | | ----------- | ----------- |--------------| | [Detect Computer Changed with Anonymous Account](/endpoint/detect_computer_changed_with_anonymous_account/) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services) | Hunting | -| [Detect Credential Dumping through LSASS access](/endpoint/detect_credential_dumping_through_lsass_access/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory) | TTP | +| [Detect Credential Dumping through LSASS access](/endpoint/detect_credential_dumping_through_lsass_access/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Detect Zerologon via Zeek](/network/detect_zerologon_via_zeek/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | #### Reference diff --git a/docs/_stories/dev_sec_ops.md b/docs/_stories/dev_sec_ops.md index dd55092a7b..591480ea30 100644 --- a/docs/_stories/dev_sec_ops.md +++ b/docs/_stories/dev_sec_ops.md @@ -30,17 +30,25 @@ DevSecOps is a collaborative framework, which thinks about application and infra | Name | Technique | Type | | ----------- | ----------- |--------------| -| [AWS ECR Container Scanning Findings High](/cloud/aws_ecr_container_scanning_findings_high/) | [Malicious Image](/tags/#malicious-image) | TTP | -| [AWS ECR Container Scanning Findings Low Informational Unknown](/cloud/aws_ecr_container_scanning_findings_low_informational_unknown/) | [Malicious Image](/tags/#malicious-image) | Hunting | -| [AWS ECR Container Scanning Findings Medium](/cloud/aws_ecr_container_scanning_findings_medium/) | [Malicious Image](/tags/#malicious-image) | Anomaly | -| [AWS ECR Container Upload Outside Business Hours](/cloud/aws_ecr_container_upload_outside_business_hours/) | [Malicious Image](/tags/#malicious-image) | Anomaly | -| [AWS ECR Container Upload Unknown User](/cloud/aws_ecr_container_upload_unknown_user/) | [Malicious Image](/tags/#malicious-image) | Anomaly | +| [AWS ECR Container Scanning Findings High](/cloud/aws_ecr_container_scanning_findings_high/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | TTP | +| [AWS ECR Container Scanning Findings Low Informational Unknown](/cloud/aws_ecr_container_scanning_findings_low_informational_unknown/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Hunting | +| [AWS ECR Container Scanning Findings Medium](/cloud/aws_ecr_container_scanning_findings_medium/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Anomaly | +| [AWS ECR Container Upload Outside Business Hours](/cloud/aws_ecr_container_upload_outside_business_hours/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Anomaly | +| [AWS ECR Container Upload Unknown User](/cloud/aws_ecr_container_upload_unknown_user/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Anomaly | | [Circle CI Disable Security Job](/cloud/circle_ci_disable_security_job/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | Anomaly | | [Circle CI Disable Security Step](/cloud/circle_ci_disable_security_step/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | Anomaly | -| [Correlation by Repository and Risk](/cloud/correlation_by_repository_and_risk/) | [Malicious Image](/tags/#malicious-image) | Correlation | -| [Correlation by User and Risk](/cloud/correlation_by_user_and_risk/) | [Malicious Image](/tags/#malicious-image) | Correlation | -| [GitHub Dependabot Alert](/cloud/github_dependabot_alert/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools) | Anomaly | -| [GitHub Pull Request from Unknown User](/cloud/github_pull_request_from_unknown_user/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools) | Anomaly | +| [Correlation by Repository and Risk](/cloud/correlation_by_repository_and_risk/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Correlation | +| [Correlation by User and Risk](/cloud/correlation_by_user_and_risk/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | Correlation | +| [GSuite Email Suspicious Attachment](/cloud/gsuite_email_suspicious_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly | +| [GitHub Dependabot Alert](/cloud/github_dependabot_alert/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise) | Anomaly | +| [GitHub Pull Request from Unknown User](/cloud/github_pull_request_from_unknown_user/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise) | Anomaly | +| [Github Commit Changes In Master](/cloud/github_commit_changes_in_master/) | [Trusted Relationship](/tags/#trusted-relationship) | Anomaly | +| [Github Commit In Develop](/cloud/github_commit_in_develop/) | [Trusted Relationship](/tags/#trusted-relationship) | Anomaly | +| [Gsuite Drive Share In External Email](/cloud/gsuite_drive_share_in_external_email/) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service) | Anomaly | +| [Gsuite Email Suspicious Subject With Attachment](/cloud/gsuite_email_suspicious_subject_with_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly | +| [Gsuite Email With Known Abuse Web Service Link](/cloud/gsuite_email_with_known_abuse_web_service_link/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly | +| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | +| [Gsuite Suspicious Shared File Name](/cloud/gsuite_suspicious_shared_file_name/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly | | [Kubernetes Nginx Ingress LFI](/cloud/kubernetes_nginx_ingress_lfi/) | [Exploitation for Credential Access](/tags/#exploitation-for-credential-access) | TTP | | [Kubernetes Nginx Ingress RFI](/cloud/kubernetes_nginx_ingress_rfi/) | [Exploitation for Credential Access](/tags/#exploitation-for-credential-access) | TTP | | [Kubernetes Scanner Image Pulling](/cloud/kubernetes_scanner_image_pulling/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | TTP | diff --git a/docs/_stories/dhs_report_ta18-074a.md b/docs/_stories/dhs_report_ta18-074a.md index be50653f90..44c93c2e37 100644 --- a/docs/_stories/dhs_report_ta18-074a.md +++ b/docs/_stories/dhs_report_ta18-074a.md @@ -34,19 +34,19 @@ Suspicious activities--spikes in SMB traffic, processes that launch netsh (to mo | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Create local admin accounts using net exe](/endpoint/create_local_admin_accounts_using_net_exe/) | [Local Account](/tags/#local-account) | TTP | -| [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account) | TTP | -| [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols) | TTP | -| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | -| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [Service Execution](/tags/#service-execution) | Hunting | -| [Malicious PowerShell Process - Execution Policy Bypass](/endpoint/malicious_powershell_process_-_execution_policy_bypass/) | [PowerShell](/tags/#powershell) | TTP | -| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | TTP | -| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | -| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | -| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | -| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | TTP | -| [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task) | TTP | -| [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [Malicious File](/tags/#malicious-file) | TTP | +| [Create local admin accounts using net exe](/endpoint/create_local_admin_accounts_using_net_exe/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | TTP | +| [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | TTP | +| [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | TTP | +| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting | +| [Malicious PowerShell Process - Execution Policy Bypass](/endpoint/malicious_powershell_process_-_execution_policy_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly | +| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly | +| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | TTP | | [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry) | TTP | #### Reference diff --git a/docs/_stories/disabling_security_tools.md b/docs/_stories/disabling_security_tools.md index 5bb9d0a846..f0069a852f 100644 --- a/docs/_stories/disabling_security_tools.md +++ b/docs/_stories/disabling_security_tools.md @@ -30,12 +30,12 @@ Attackers employ a variety of tactics in order to avoid detection and operate wi | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Attempt To Add Certificate To Untrusted Store](/endpoint/attempt_to_add_certificate_to_untrusted_store/) | [Install Root Certificate](/tags/#install-root-certificate) | TTP | -| [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | TTP | -| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | TTP | +| [Attempt To Add Certificate To Untrusted Store](/endpoint/attempt_to_add_certificate_to_untrusted_store/) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls) | TTP | +| [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry) | TTP | -| [Unload Sysmon Filter Driver](/endpoint/unload_sysmon_filter_driver/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Unload Sysmon Filter Driver](/endpoint/unload_sysmon_filter_driver/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | #### Reference diff --git a/docs/_stories/dns_amplification_attacks.md b/docs/_stories/dns_amplification_attacks.md index 81bfca4696..20cbc0f0fa 100644 --- a/docs/_stories/dns_amplification_attacks.md +++ b/docs/_stories/dns_amplification_attacks.md @@ -31,7 +31,7 @@ The search in this story can help you to detect if attackers are abusing your co | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Large Volume of DNS ANY Queries](/network/large_volume_of_dns_any_queries/) | [Reflection Amplification](/tags/#reflection-amplification) | Anomaly | +| [Large Volume of DNS ANY Queries](/network/large_volume_of_dns_any_queries/) | [Network Denial of Service](/tags/#network-denial-of-service), [Reflection Amplification](/tags/#reflection-amplification) | Anomaly | #### Reference diff --git a/docs/_stories/emotet_malware__dhs_report_ta18-201a_.md b/docs/_stories/emotet_malware__dhs_report_ta18-201a_.md index f6a61bd541..6558b3ffe4 100644 --- a/docs/_stories/emotet_malware__dhs_report_ta18-201a_.md +++ b/docs/_stories/emotet_malware__dhs_report_ta18-201a_.md @@ -35,13 +35,13 @@ The searches in this Analytic Story will help you find executables that are rare | Name | Technique | Type | | ----------- | ----------- |--------------| | [Detect Rare Executables](/endpoint/detect_rare_executables/) | | Anomaly | -| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Windows Command Shell](/tags/#windows-command-shell) | TTP | +| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | TTP | | [Detection of tools built by NirSoft](/endpoint/detection_of_tools_built_by_nirsoft/) | [Software Deployment Tools](/tags/#software-deployment-tools) | TTP | | [Email Attachments With Lots Of Spaces](/application/email_attachments_with_lots_of_spaces/) | | Anomaly | -| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | -| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | -| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | -| [Suspicious Email Attachment Extensions](/application/suspicious_email_attachment_extensions/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | +| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly | +| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly | +| [Suspicious Email Attachment Extensions](/application/suspicious_email_attachment_extensions/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly | #### Reference diff --git a/docs/_stories/fin7.md b/docs/_stories/fin7.md index d73fff95c4..8169adafd2 100644 --- a/docs/_stories/fin7.md +++ b/docs/_stories/fin7.md @@ -31,14 +31,16 @@ FIN7 is a Russian criminal advanced persistent threat group that has primarily t | Name | Technique | Type | | ----------- | ----------- |--------------| | [Check Elevated CMD using whoami](/endpoint/check_elevated_cmd_using_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | TTP | -| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [JavaScript](/tags/#javascript) | TTP | -| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [JavaScript](/tags/#javascript) | TTP | -| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [JavaScript](/tags/#javascript) | Anomaly | -| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [JavaScript](/tags/#javascript) | Anomaly | -| [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly | -| [Non Firefox Process Access Firefox Profile Dir](/endpoint/non_firefox_process_access_firefox_profile_dir/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly | -| [Office Application Drop Executable](/endpoint/office_application_drop_executable/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawning Wmic](/endpoint/office_product_spawning_wmic/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | TTP | +| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | TTP | +| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | Anomaly | +| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | Anomaly | +| [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly | +| [Non Firefox Process Access Firefox Profile Dir](/endpoint/non_firefox_process_access_firefox_profile_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly | +| [Office Application Drop Executable](/endpoint/office_application_drop_executable/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning Wmic](/endpoint/office_product_spawning_wmic/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Vbscript Execution Using Wscript App](/endpoint/vbscript_execution_using_wscript_app/) | [Visual Basic](/tags/#visual-basic), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | +| [Wscript Or Cscript Suspicious Child Process](/endpoint/wscript_or_cscript_suspicious_child_process/) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | TTP | | [XSL Script Execution With WMIC](/endpoint/xsl_script_execution_with_wmic/) | [XSL Script Processing](/tags/#xsl-script-processing) | TTP | #### Reference diff --git a/docs/_stories/hafnium_group.md b/docs/_stories/hafnium_group.md index cf3bc9c9da..6d3a1a8b13 100644 --- a/docs/_stories/hafnium_group.md +++ b/docs/_stories/hafnium_group.md @@ -33,21 +33,21 @@ The following Splunk detections assist with identifying the HAFNIUM groups trade | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell) | TTP | -| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Web Shell](/tags/#web-shell) | TTP | -| [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account) | TTP | -| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | -| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [Service Execution](/tags/#service-execution) | Hunting | -| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Dump LSASS via procdump](/endpoint/dump_lsass_via_procdump/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Email servers sending high volume traffic to hosts](/application/email_servers_sending_high_volume_traffic_to_hosts/) | [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | -| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell) | Hunting | -| [Malicious PowerShell Process - Execution Policy Bypass](/endpoint/malicious_powershell_process_-_execution_policy_bypass/) | [PowerShell](/tags/#powershell) | TTP | -| [Nishang PowershellTCPOneLine](/endpoint/nishang_powershelltcponeline/) | [PowerShell](/tags/#powershell) | TTP | -| [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds) | TTP | -| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [PowerShell](/tags/#powershell) | TTP | +| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | TTP | +| [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | TTP | +| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting | +| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Dump LSASS via procdump](/endpoint/dump_lsass_via_procdump/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Email servers sending high volume traffic to hosts](/application/email_servers_sending_high_volume_traffic_to_hosts/) | [Email Collection](/tags/#email-collection), [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | +| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Hunting | +| [Malicious PowerShell Process - Execution Policy Bypass](/endpoint/malicious_powershell_process_-_execution_policy_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [Nishang PowershellTCPOneLine](/endpoint/nishang_powershelltcponeline/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [Unified Messaging Service Spawning a Process](/endpoint/unified_messaging_service_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | -| [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Web Shell](/tags/#web-shell) | TTP | +| [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | TTP | #### Reference diff --git a/docs/_stories/hidden_cobra_malware.md b/docs/_stories/hidden_cobra_malware.md index 1a7f8130ab..309ad02f0c 100644 --- a/docs/_stories/hidden_cobra_malware.md +++ b/docs/_stories/hidden_cobra_malware.md @@ -35,14 +35,14 @@ Among other searches in this Analytic Story is a detection search that looks for | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Create or delete windows shares using net exe](/endpoint/create_or_delete_windows_shares_using_net_exe/) | [Network Share Connection Removal](/tags/#network-share-connection-removal) | TTP | -| [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns) | Anomaly | -| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | -| [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols) | TTP | -| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | Anomaly | -| [Remote Desktop Process Running On System](/endpoint/remote_desktop_process_running_on_system/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | Hunting | -| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | -| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | +| [Create or delete windows shares using net exe](/endpoint/create_or_delete_windows_shares_using_net_exe/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Network Share Connection Removal](/tags/#network-share-connection-removal) | TTP | +| [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol) | Anomaly | +| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | +| [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | TTP | +| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | Anomaly | +| [Remote Desktop Process Running On System](/endpoint/remote_desktop_process_running_on_system/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | Hunting | +| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly | +| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly | #### Reference diff --git a/docs/_stories/icedid.md b/docs/_stories/icedid.md index 6fb742cf7b..c85e6a9f66 100644 --- a/docs/_stories/icedid.md +++ b/docs/_stories/icedid.md @@ -30,30 +30,30 @@ IcedId banking trojan campaigns targeting banks and other vertical sectors.This | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | TTP | +| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | | [CHCP Command Execution](/endpoint/chcp_command_execution/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | | [Create Remote Thread In Shell Application](/endpoint/create_remote_thread_in_shell_application/) | [Process Injection](/tags/#process-injection) | TTP | -| [Drop IcedID License dat](/endpoint/drop_icedid_license_dat/) | [Malicious File](/tags/#malicious-file) | Hunting | -| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [IcedID Exfiltrated Archived File Creation](/endpoint/icedid_exfiltrated_archived_file_creation/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | -| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Mshta](/tags/#mshta) | TTP | +| [Drop IcedID License dat](/endpoint/drop_icedid_license_dat/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | Hunting | +| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [IcedID Exfiltrated Archived File Creation](/endpoint/icedid_exfiltrated_archived_file_creation/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting | +| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | | [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | -| [Office Application Spawn Regsvr32 process](/endpoint/office_application_spawn_regsvr32_process/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawning MSHTA](/endpoint/office_product_spawning_mshta/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | +| [Office Application Spawn Regsvr32 process](/endpoint/office_application_spawn_regsvr32_process/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning MSHTA](/endpoint/office_product_spawning_mshta/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Rundll32 Create Remote Thread To A Process](/endpoint/rundll32_create_remote_thread_to_a_process/) | [Process Injection](/tags/#process-injection) | TTP | | [Rundll32 CreateRemoteThread In Browser](/endpoint/rundll32_createremotethread_in_browser/) | [Process Injection](/tags/#process-injection) | TTP | -| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [Rundll32](/tags/#rundll32) | TTP | -| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | | [Sqlite Module In Temp Folder](/endpoint/sqlite_module_in_temp_folder/) | [Data from Local System](/tags/#data-from-local-system) | TTP | -| [Suspicious IcedID Regsvr32 Cmdline](/endpoint/suspicious_icedid_regsvr32_cmdline/) | [Regsvr32](/tags/#regsvr32) | TTP | -| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Rundll32](/tags/#rundll32) | TTP | -| [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [Rundll32](/tags/#rundll32) | TTP | -| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [Suspicious IcedID Regsvr32 Cmdline](/endpoint/suspicious_icedid_regsvr32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | TTP | +| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | #### Reference diff --git a/docs/_stories/ingress_tool_transfer.md b/docs/_stories/ingress_tool_transfer.md index 2f10eee4b7..5db1b3f1de 100644 --- a/docs/_stories/ingress_tool_transfer.md +++ b/docs/_stories/ingress_tool_transfer.md @@ -30,8 +30,8 @@ Ingress tool transfer is a Technique under tactic Command and Control. Behaviors | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [PowerShell](/tags/#powershell) | TTP | -| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell) | TTP | +| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [BITSAdmin Download File](/endpoint/bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [CertUtil Download With VerifyCtl and Split Arguments](/endpoint/certutil_download_with_verifyctl_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | diff --git a/docs/_stories/lateral_movement.md b/docs/_stories/lateral_movement.md index f38f1ba842..0b4c8f3fc8 100644 --- a/docs/_stories/lateral_movement.md +++ b/docs/_stories/lateral_movement.md @@ -35,16 +35,16 @@ If there is evidence of lateral movement, it is imperative for analysts to colle | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Activity Related to Pass the Hash Attacks](/endpoint/detect_activity_related_to_pass_the_hash_attacks/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | -| [Detect Pass the Hash](/endpoint/detect_pass_the_hash/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | -| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | -| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [Service Execution](/tags/#service-execution) | Hunting | -| [Kerberoasting spn request with RC4 encryption](/endpoint/kerberoasting_spn_request_with_rc4_encryption/) | [Kerberoasting](/tags/#kerberoasting) | TTP | -| [Potential Pass the Token or Hash Observed at the Destination Device](/endpoint/potential_pass_the_token_or_hash_observed_at_the_destination_device/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | -| [Potential Pass the Token or Hash Observed by an Event Collecting Device](/endpoint/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | -| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | Anomaly | -| [Remote Desktop Process Running On System](/endpoint/remote_desktop_process_running_on_system/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | Hunting | -| [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [Detect Activity Related to Pass the Hash Attacks](/endpoint/detect_activity_related_to_pass_the_hash_attacks/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [Detect Pass the Hash](/endpoint/detect_pass_the_hash/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting | +| [Kerberoasting spn request with RC4 encryption](/endpoint/kerberoasting_spn_request_with_rc4_encryption/) | [Kerberoasting](/tags/#kerberoasting), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | +| [Potential Pass the Token or Hash Observed at the Destination Device](/endpoint/potential_pass_the_token_or_hash_observed_at_the_destination_device/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [Potential Pass the Token or Hash Observed by an Event Collecting Device](/endpoint/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | Anomaly | +| [Remote Desktop Process Running On System](/endpoint/remote_desktop_process_running_on_system/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | Hunting | +| [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | #### Reference diff --git a/docs/_stories/malicious_powershell.md b/docs/_stories/malicious_powershell.md index be85b9e892..8a20104c07 100644 --- a/docs/_stories/malicious_powershell.md +++ b/docs/_stories/malicious_powershell.md @@ -41,33 +41,33 @@ Most recently we have added new content related to PowerShell Script Block loggi | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [PowerShell](/tags/#powershell) | TTP | -| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell) | TTP | +| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [Credential Extraction indicative of use of DSInternals credential conversion modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of use of DSInternals modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of use of PowerSploit modules](/endpoint/credential_extraction_indicative_of_use_of_powersploit_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals](/endpoint/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [PowerShell](/tags/#powershell) | TTP | +| [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Illegal Access To User Content via PowerSploit modules](/endpoint/illegal_access_to_user_content_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking) | TTP | | [Illegal Privilege Elevation and Persistence via PowerSploit modules](/endpoint/illegal_privilege_elevation_and_persistence_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [Illegal Service and Process Control via PowerSploit modules](/endpoint/illegal_service_and_process_control_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP | -| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell) | Hunting | +| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Hunting | | [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | Hunting | -| [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [PowerShell](/tags/#powershell) | TTP | -| [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [PowerShell](/tags/#powershell) | Hunting | -| [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [PowerShell](/tags/#powershell) | TTP | -| [PowerShell Loading DotNET into Memory via System Reflection Assembly](/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly/) | [PowerShell](/tags/#powershell) | TTP | -| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | -| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | -| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking) | TTP | -| [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell) | TTP | -| [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell) | TTP | -| [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [PowerShell](/tags/#powershell) | TTP | +| [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | Hunting | +| [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [PowerShell Loading DotNET into Memory via System Reflection Assembly](/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | +| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | +| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell) | TTP | +| [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell) | TTP | +| [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | TTP | | [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP | | [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP | -| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [PowerShell](/tags/#powershell) | TTP | +| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses) | TTP | | [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP | diff --git a/docs/_stories/masquerading_-_rename_system_utilities.md b/docs/_stories/masquerading_-_rename_system_utilities.md index e0c606ef45..9353929e34 100644 --- a/docs/_stories/masquerading_-_rename_system_utilities.md +++ b/docs/_stories/masquerading_-_rename_system_utilities.md @@ -32,13 +32,14 @@ There will be false positives as some native Windows processes are moved or ran | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | -| [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | -| [Suspicious Rundll32 Rename](/endpoint/suspicious_rundll32_rename/) | [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | -| [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | -| [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [Sdelete Application Execution](/endpoint/sdelete_application_execution/) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | +| [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP | +| [Suspicious Rundll32 Rename](/endpoint/suspicious_rundll32_rename/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP | | [System Process Running from Unexpected Location](/endpoint/system_process_running_from_unexpected_location/) | [Masquerading](/tags/#masquerading) | Anomaly | -| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | #### Reference diff --git a/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md b/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md index 690f586cf2..3ef88c84bf 100644 --- a/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md +++ b/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md @@ -32,12 +32,12 @@ Microsoft is aware of targeted attacks that attempt to exploit this vulnerabilit | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Control Panel](/tags/#control-panel) | TTP | -| [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Writing cab or inf](/endpoint/office_product_writing_cab_or_inf/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Spawning Control](/endpoint/office_spawning_control/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Rundll32](/tags/#rundll32) | Hunting | -| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Rundll32](/tags/#rundll32) | TTP | +| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel) | TTP | +| [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Writing cab or inf](/endpoint/office_product_writing_cab_or_inf/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Spawning Control](/endpoint/office_spawning_control/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | Hunting | +| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | #### Reference diff --git a/docs/_stories/netsh_abuse.md b/docs/_stories/netsh_abuse.md index fc4228b9c5..761f9dbde9 100644 --- a/docs/_stories/netsh_abuse.md +++ b/docs/_stories/netsh_abuse.md @@ -31,7 +31,7 @@ To get started, run the detection search to identify parent processes of `netsh. | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | TTP | +| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | #### Reference diff --git a/docs/_stories/nobelium_group.md b/docs/_stories/nobelium_group.md index bce9583086..85137ca19b 100644 --- a/docs/_stories/nobelium_group.md +++ b/docs/_stories/nobelium_group.md @@ -32,18 +32,18 @@ This Analytic Story supports you to detect Tactics, Techniques and Procedures (T | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility) | Anomaly | -| [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols) | TTP | -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell) | Hunting | -| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Mshta](/tags/#mshta) | TTP | -| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution) | Anomaly | +| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Anomaly | +| [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | TTP | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting | +| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly | | [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | Hunting | -| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | TTP | -| [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task) | TTP | -| [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | | [Sunburst Correlation DLL and Network Event](/endpoint/sunburst_correlation_dll_and_network_event/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | TTP | | [Supernova Webshell](/web/supernova_webshell/) | [Web Shell](/tags/#web-shell) | TTP | -| [TOR Traffic](/network/tor_traffic/) | [Web Protocols](/tags/#web-protocols) | TTP | +| [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | TTP | | [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | #### Reference diff --git a/docs/_stories/office_365_detections.md b/docs/_stories/office_365_detections.md index ffbbb892c1..759d539258 100644 --- a/docs/_stories/office_365_detections.md +++ b/docs/_stories/office_365_detections.md @@ -30,18 +30,18 @@ More and more companies are using Microsofts Office 365 cloud offering. Therefor | Name | Technique | Type | | ----------- | ----------- |--------------| -| [High Number of Login Failures from a single source](/cloud/high_number_of_login_failures_from_a_single_source/) | [Password Guessing](/tags/#password-guessing) | Anomaly | -| [O365 Add App Role Assignment Grant User](/cloud/o365_add_app_role_assignment_grant_user/) | [Cloud Account](/tags/#cloud-account) | TTP | -| [O365 Added Service Principal](/cloud/o365_added_service_principal/) | [Cloud Account](/tags/#cloud-account) | TTP | -| [O365 Bypass MFA via Trusted IP](/cloud/o365_bypass_mfa_via_trusted_ip/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | +| [High Number of Login Failures from a single source](/cloud/high_number_of_login_failures_from_a_single_source/) | [Password Guessing](/tags/#password-guessing), [Brute Force](/tags/#brute-force) | Anomaly | +| [O365 Add App Role Assignment Grant User](/cloud/o365_add_app_role_assignment_grant_user/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | +| [O365 Added Service Principal](/cloud/o365_added_service_principal/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | +| [O365 Bypass MFA via Trusted IP](/cloud/o365_bypass_mfa_via_trusted_ip/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | | [O365 Disable MFA](/cloud/o365_disable_mfa/) | [Modify Authentication Process](/tags/#modify-authentication-process) | TTP | | [O365 Excessive Authentication Failures Alert](/cloud/o365_excessive_authentication_failures_alert/) | [Brute Force](/tags/#brute-force) | Anomaly | | [O365 Excessive SSO logon errors](/cloud/o365_excessive_sso_logon_errors/) | [Modify Authentication Process](/tags/#modify-authentication-process) | Anomaly | -| [O365 New Federated Domain Added](/cloud/o365_new_federated_domain_added/) | [Cloud Account](/tags/#cloud-account) | TTP | +| [O365 New Federated Domain Added](/cloud/o365_new_federated_domain_added/) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account) | TTP | | [O365 PST export alert](/cloud/o365_pst_export_alert/) | [Email Collection](/tags/#email-collection) | TTP | -| [O365 Suspicious Admin Email Forwarding](/cloud/o365_suspicious_admin_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | Anomaly | -| [O365 Suspicious Rights Delegation](/cloud/o365_suspicious_rights_delegation/) | [Remote Email Collection](/tags/#remote-email-collection) | TTP | -| [O365 Suspicious User Email Forwarding](/cloud/o365_suspicious_user_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | Anomaly | +| [O365 Suspicious Admin Email Forwarding](/cloud/o365_suspicious_admin_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule), [Email Collection](/tags/#email-collection) | Anomaly | +| [O365 Suspicious Rights Delegation](/cloud/o365_suspicious_rights_delegation/) | [Remote Email Collection](/tags/#remote-email-collection), [Email Collection](/tags/#email-collection) | TTP | +| [O365 Suspicious User Email Forwarding](/cloud/o365_suspicious_user_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule), [Email Collection](/tags/#email-collection) | Anomaly | #### Reference diff --git a/docs/_stories/orangeworm_attack_group.md b/docs/_stories/orangeworm_attack_group.md index e231aa5f2d..9d73c2bd2d 100644 --- a/docs/_stories/orangeworm_attack_group.md +++ b/docs/_stories/orangeworm_attack_group.md @@ -33,8 +33,8 @@ This Analytic Story is designed to help you detect and investigate suspicious ac | Name | Technique | Type | | ----------- | ----------- |--------------| -| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution) | Anomaly | -| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | TTP | +| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly | +| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | #### Reference diff --git a/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md b/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md index aa1c32cb06..720316b7bf 100644 --- a/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md +++ b/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md @@ -57,8 +57,8 @@ If behavioral searches included in this story yield positive hits, iDefense reco | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell) | Hunting | -| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | +| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Hunting | +| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) | | Anomaly | | [Unusually Long Command Line - MLTK](/endpoint/unusually_long_command_line_-_mltk/) | | Anomaly | diff --git a/docs/_stories/printnightmare_cve-2021-34527.md b/docs/_stories/printnightmare_cve-2021-34527.md index bf16400e8c..84139f4aed 100644 --- a/docs/_stories/printnightmare_cve-2021-34527.md +++ b/docs/_stories/printnightmare_cve-2021-34527.md @@ -35,15 +35,15 @@ In the most impactful scenario, an attacker would be able to leverage this vulne | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Print Spooler Adding A Printer Driver](/endpoint/print_spooler_adding_a_printer_driver/) | [Print Processors](/tags/#print-processors) | TTP | -| [Print Spooler Failed to Load a Plug-in](/endpoint/print_spooler_failed_to_load_a_plug-in/) | [Print Processors](/tags/#print-processors) | TTP | -| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Rundll32](/tags/#rundll32) | TTP | -| [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors) | TTP | -| [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors) | TTP | +| [Print Spooler Adding A Printer Driver](/endpoint/print_spooler_adding_a_printer_driver/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Print Spooler Failed to Load a Plug-in](/endpoint/print_spooler_failed_to_load_a_plug-in/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Spoolsv Suspicious Process Access](/endpoint/spoolsv_suspicious_process_access/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | -| [Spoolsv Writing a DLL](/endpoint/spoolsv_writing_a_dll/) | [Print Processors](/tags/#print-processors) | TTP | -| [Spoolsv Writing a DLL - Sysmon](/endpoint/spoolsv_writing_a_dll_-_sysmon/) | [Print Processors](/tags/#print-processors) | TTP | -| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Rundll32](/tags/#rundll32) | TTP | +| [Spoolsv Writing a DLL](/endpoint/spoolsv_writing_a_dll/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Spoolsv Writing a DLL - Sysmon](/endpoint/spoolsv_writing_a_dll_-_sysmon/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | #### Reference diff --git a/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md b/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md index 661f68cdf9..9e7df70211 100644 --- a/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md +++ b/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md @@ -32,13 +32,13 @@ A traditional security best practice is to control the ports, protocols, and ser | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Allow Inbound Traffic By Firewall Rule Registry](/endpoint/allow_inbound_traffic_by_firewall_rule_registry/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | -| [Allow Inbound Traffic In Firewall Rule](/endpoint/allow_inbound_traffic_in_firewall_rule/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | +| [Allow Inbound Traffic By Firewall Rule Registry](/endpoint/allow_inbound_traffic_by_firewall_rule_registry/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | TTP | +| [Allow Inbound Traffic In Firewall Rule](/endpoint/allow_inbound_traffic_in_firewall_rule/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | TTP | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | TTP | | [Enable RDP In Other Port Number](/endpoint/enable_rdp_in_other_port_number/) | [Remote Services](/tags/#remote-services) | TTP | | [Prohibited Network Traffic Allowed](/network/prohibited_network_traffic_allowed/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | -| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | -| [TOR Traffic](/network/tor_traffic/) | [Web Protocols](/tags/#web-protocols) | TTP | +| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | +| [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | TTP | #### Reference diff --git a/docs/_stories/proxyshell.md b/docs/_stories/proxyshell.md index d6e0914329..ecfffcc430 100644 --- a/docs/_stories/proxyshell.md +++ b/docs/_stories/proxyshell.md @@ -34,10 +34,10 @@ Upon successful exploitation, the remote attacker will have `SYSTEM` privileges | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Web Shell](/tags/#web-shell) | TTP | +| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | TTP | | [Exchange PowerShell Abuse via SSRF](/endpoint/exchange_powershell_abuse_via_ssrf/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | -| [Exchange PowerShell Module Usage](/endpoint/exchange_powershell_module_usage/) | [PowerShell](/tags/#powershell) | TTP | -| [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Web Shell](/tags/#web-shell) | TTP | +| [Exchange PowerShell Module Usage](/endpoint/exchange_powershell_module_usage/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | TTP | #### Reference diff --git a/docs/_stories/ransomware.md b/docs/_stories/ransomware.md index e5f56c6f11..d1048a1d45 100644 --- a/docs/_stories/ransomware.md +++ b/docs/_stories/ransomware.md @@ -31,15 +31,15 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e | Name | Technique | Type | | ----------- | ----------- |--------------| -| [7zip CommandLine To SMB Share Path](/endpoint/7zip_commandline_to_smb_share_path/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | -| [Allow File And Printing Sharing In Firewall](/endpoint/allow_file_and_printing_sharing_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | -| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | +| [7zip CommandLine To SMB Share Path](/endpoint/7zip_commandline_to_smb_share_path/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting | +| [Allow File And Printing Sharing In Firewall](/endpoint/allow_file_and_printing_sharing_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Allow Operation with Consent Admin](/endpoint/allow_operation_with_consent_admin/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP | | [Attempt To delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop) | TTP | | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | -| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [CMSTP](/tags/#cmstp) | TTP | -| [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion) | TTP | +| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP | +| [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP | @@ -48,58 +48,58 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e | [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP | | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Hunting | -| [Detect SharpHound Command-Line Arguments](/endpoint/detect_sharphound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | -| [Detect SharpHound File Modifications](/endpoint/detect_sharphound_file_modifications/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | -| [Detect SharpHound Usage](/endpoint/detect_sharphound_usage/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | -| [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disable ETW Through Registry](/endpoint/disable_etw_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disable Logs Using WevtUtil](/endpoint/disable_logs_using_wevtutil/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Detect SharpHound Command-Line Arguments](/endpoint/detect_sharphound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | TTP | +| [Detect SharpHound File Modifications](/endpoint/detect_sharphound_file_modifications/) | [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | TTP | +| [Detect SharpHound Usage](/endpoint/detect_sharphound_usage/) | [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | TTP | +| [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disable ETW Through Registry](/endpoint/disable_etw_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disable Logs Using WevtUtil](/endpoint/disable_logs_using_wevtutil/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | | [Disable Net User Account](/endpoint/disable_net_user_account/) | [Service Stop](/tags/#service-stop) | TTP | -| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Excessive Service Stop Attempt](/endpoint/excessive_service_stop_attempt/) | [Service Stop](/tags/#service-stop) | Anomaly | | [Excessive Usage Of Net App](/endpoint/excessive_usage_of_net_app/) | [Account Access Removal](/tags/#account-access-removal) | Anomaly | -| [Excessive Usage Of SC Service Utility](/endpoint/excessive_usage_of_sc_service_utility/) | [Service Execution](/tags/#service-execution) | Anomaly | -| [Execute Javascript With Jscript COM CLSID](/endpoint/execute_javascript_with_jscript_com_clsid/) | [Visual Basic](/tags/#visual-basic) | TTP | +| [Excessive Usage Of SC Service Utility](/endpoint/excessive_usage_of_sc_service_utility/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly | +| [Execute Javascript With Jscript COM CLSID](/endpoint/execute_javascript_with_jscript_com_clsid/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic) | TTP | | [Fsutil Zeroing File](/endpoint/fsutil_zeroing_file/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | | [ICACLS Grant Command](/endpoint/icacls_grant_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | | [Known Services Killed by Ransomware](/endpoint/known_services_killed_by_ransomware/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | TTP | -| [Msmpeng Application DLL Side Loading](/endpoint/msmpeng_application_dll_side_loading/) | [DLL Side-Loading](/tags/#dll-side-loading) | TTP | +| [Msmpeng Application DLL Side Loading](/endpoint/msmpeng_application_dll_side_loading/) | [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | | [Permission Modification using Takeown App](/endpoint/permission_modification_using_takeown_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | -| [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | -| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking) | TTP | +| [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | +| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | | [Prevent Automatic Repair Mode using Bcdedit](/endpoint/prevent_automatic_repair_mode_using_bcdedit/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Prohibited Network Traffic Allowed](/network/prohibited_network_traffic_allowed/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | | [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP | -| [Recursive Delete of Directory In Batch CMD](/endpoint/recursive_delete_of_directory_in_batch_cmd/) | [File Deletion](/tags/#file-deletion) | TTP | -| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | +| [Recursive Delete of Directory In Batch CMD](/endpoint/recursive_delete_of_directory_in_batch_cmd/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | +| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Remote Process Instantiation via WMI](/endpoint/remote_process_instantiation_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | | [Resize Shadowstorage Volume](/endpoint/resize_shadowstorage_volume/) | [Service Stop](/tags/#service-stop) | TTP | | [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP | | [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry) | TTP | -| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | -| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | -| [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly | +| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly | +| [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | | [Spike in File Writes](/endpoint/spike_in_file_writes/) | | Anomaly | -| [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | -| [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task) | Anomaly | -| [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | -| [TOR Traffic](/network/tor_traffic/) | [Web Protocols](/tags/#web-protocols) | TTP | -| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [CMSTP](/tags/#cmstp) | TTP | +| [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly | +| [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | +| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | TTP | +| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP | | [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | -| [Uninstall App Using MsiExec](/endpoint/uninstall_app_using_msiexec/) | [Msiexec](/tags/#msiexec) | TTP | +| [Uninstall App Using MsiExec](/endpoint/uninstall_app_using_msiexec/) | [Msiexec](/tags/#msiexec), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP | | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) | | Anomaly | | [Unusually Long Command Line - MLTK](/endpoint/unusually_long_command_line_-_mltk/) | | Anomaly | | [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | -| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [CMSTP](/tags/#cmstp) | TTP | -| [WevtUtil Usage To Clear Logs](/endpoint/wevtutil_usage_to_clear_logs/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [Wevtutil Usage To Disable Logs](/endpoint/wevtutil_usage_to_disable_logs/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task) | TTP | -| [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task) | TTP | -| [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP | +| [WevtUtil Usage To Clear Logs](/endpoint/wevtutil_usage_to_clear_logs/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Wevtutil Usage To Disable Logs](/endpoint/wevtutil_usage_to_disable_logs/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | #### Reference diff --git a/docs/_stories/remcos.md b/docs/_stories/remcos.md index 508bfb87f9..f111d8417c 100644 --- a/docs/_stories/remcos.md +++ b/docs/_stories/remcos.md @@ -30,15 +30,20 @@ Remcos or Remote Control and Surveillance, marketed as a legitimate software for | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading) | TTP | +| [Malicious InProcServer32 Modification](/endpoint/malicious_inprocserver32_modification/) | [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry) | TTP | | [Process Deleting Its Process File Path](/endpoint/process_deleting_its_process_file_path/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | -| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | +| [Process Writing DynamicWrapperX](/endpoint/process_writing_dynamicwrapperx/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Component Object Model](/tags/#component-object-model) | Hunting | +| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Remcos RAT File Creation in Remcos Folder](/endpoint/remcos_rat_file_creation_in_remcos_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | | [Remcos client registry install entry](/endpoint/remcos_client_registry_install_entry/) | [Modify Registry](/tags/#modify-registry) | TTP | | [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | | [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Suspicious WAV file in Appdata Folder](/endpoint/suspicious_wav_file_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | +| [Vbscript Execution Using Wscript App](/endpoint/vbscript_execution_using_wscript_app/) | [Visual Basic](/tags/#visual-basic), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | +| [Winhlp32 Spawning a Process](/endpoint/winhlp32_spawning_a_process/) | [Process Injection](/tags/#process-injection) | TTP | +| [Wscript Or Cscript Suspicious Child Process](/endpoint/wscript_or_cscript_suspicious_child_process/) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | TTP | #### Reference diff --git a/docs/_stories/revil_ransomware.md b/docs/_stories/revil_ransomware.md index 04684d21d3..1d8a5867fe 100644 --- a/docs/_stories/revil_ransomware.md +++ b/docs/_stories/revil_ransomware.md @@ -30,15 +30,15 @@ Revil ransomware is a RaaS,that a single group may operates and manges the devel | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | +| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Delete ShadowCopy With PowerShell](/endpoint/delete_shadowcopy_with_powershell/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | -| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | TTP | -| [Msmpeng Application DLL Side Loading](/endpoint/msmpeng_application_dll_side_loading/) | [DLL Side-Loading](/tags/#dll-side-loading) | TTP | -| [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Msmpeng Application DLL Side Loading](/endpoint/msmpeng_application_dll_side_loading/) | [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | +| [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP | | [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry) | TTP | -| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [CMSTP](/tags/#cmstp) | TTP | +| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP | #### Reference diff --git a/docs/_stories/router_and_infrastructure_security.md b/docs/_stories/router_and_infrastructure_security.md index d31565bc42..712d88188f 100644 --- a/docs/_stories/router_and_infrastructure_security.md +++ b/docs/_stories/router_and_infrastructure_security.md @@ -32,13 +32,13 @@ This Analytic Story helps you gain a better understanding of how your network de | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | -| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | | [Detect New Login Attempts to Routers](/application/detect_new_login_attempts_to_routers/) | | TTP | -| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | | [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle) | TTP | -| [Detect Software Download To Network Device](/network/detect_software_download_to_network_device/) | [TFTP Boot](/tags/#tftp-boot) | TTP | -| [Detect Traffic Mirroring](/network/detect_traffic_mirroring/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | TTP | +| [Detect Software Download To Network Device](/network/detect_software_download_to_network_device/) | [TFTP Boot](/tags/#tftp-boot), [Pre-OS Boot](/tags/#pre-os-boot) | TTP | +| [Detect Traffic Mirroring](/network/detect_traffic_mirroring/) | [Hardware Additions](/tags/#hardware-additions), [Automated Exfiltration](/tags/#automated-exfiltration), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | TTP | #### Reference diff --git a/docs/_stories/ryuk_ransomware.md b/docs/_stories/ryuk_ransomware.md index 0e3e682295..eda620fe81 100644 --- a/docs/_stories/ryuk_ransomware.md +++ b/docs/_stories/ryuk_ransomware.md @@ -35,16 +35,16 @@ Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) o | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | -| [Remote Desktop Network Bruteforce](/network/remote_desktop_network_bruteforce/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | -| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | Anomaly | +| [Remote Desktop Network Bruteforce](/network/remote_desktop_network_bruteforce/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | TTP | +| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | Anomaly | | [Ryuk Test Files Detected](/endpoint/ryuk_test_files_detected/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | TTP | -| [Ryuk Wake on LAN Command](/endpoint/ryuk_wake_on_lan_command/) | [Windows Command Shell](/tags/#windows-command-shell) | TTP | +| [Ryuk Wake on LAN Command](/endpoint/ryuk_wake_on_lan_command/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | TTP | | [Spike in File Writes](/endpoint/spike_in_file_writes/) | | Anomaly | -| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task) | Anomaly | +| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly | | [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | -| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task) | TTP | -| [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task) | TTP | -| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | TTP | #### Reference diff --git a/docs/_stories/samsam_ransomware.md b/docs/_stories/samsam_ransomware.md index ee80e1cccb..df30a5bf30 100644 --- a/docs/_stories/samsam_ransomware.md +++ b/docs/_stories/samsam_ransomware.md @@ -37,18 +37,18 @@ This Analytic Story includes searches designed to help detect and investigate si | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Batch File Write to System32](/endpoint/batch_file_write_to_system32/) | [Malicious File](/tags/#malicious-file) | TTP | +| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning) | TTP | +| [Batch File Write to System32](/endpoint/batch_file_write_to_system32/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | TTP | | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | -| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | -| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [Service Execution](/tags/#service-execution) | Hunting | +| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting | | [Detect attackers scanning for vulnerable JBoss servers](/web/detect_attackers_scanning_for_vulnerable_jboss_servers/) | [System Information Discovery](/tags/#system-information-discovery) | TTP | | [Detect malicious requests to exploit JBoss servers](/web/detect_malicious_requests_to_exploit_jboss_servers/) | | TTP | | [File with Samsam Extension](/endpoint/file_with_samsam_extension/) | | TTP | -| [Remote Desktop Network Bruteforce](/network/remote_desktop_network_bruteforce/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | -| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | Anomaly | +| [Remote Desktop Network Bruteforce](/network/remote_desktop_network_bruteforce/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | TTP | +| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | Anomaly | | [Samsam Test File Write](/endpoint/samsam_test_file_write/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | TTP | | [Spike in File Writes](/endpoint/spike_in_file_writes/) | | Anomaly | diff --git a/docs/_stories/silver_sparrow.md b/docs/_stories/silver_sparrow.md index a916b4ee1e..f5a1f8dc55 100644 --- a/docs/_stories/silver_sparrow.md +++ b/docs/_stories/silver_sparrow.md @@ -31,8 +31,8 @@ Silver Sparrow works is a dropper and uses typical persistence mechanisms on a M | Name | Technique | Type | | ----------- | ----------- |--------------| | [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | -| [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent) | TTP | -| [Suspicious PlistBuddy Usage via OSquery](/endpoint/suspicious_plistbuddy_usage_via_osquery/) | [Launch Agent](/tags/#launch-agent) | TTP | +| [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [Suspicious PlistBuddy Usage via OSquery](/endpoint/suspicious_plistbuddy_usage_via_osquery/) | [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Suspicious SQLite3 LSQuarantine Behavior](/endpoint/suspicious_sqlite3_lsquarantine_behavior/) | [Data Staged](/tags/#data-staged) | TTP | #### Reference diff --git a/docs/_stories/spearphishing_attachments.md b/docs/_stories/spearphishing_attachments.md index b1fbcd12f4..30a3e27168 100644 --- a/docs/_stories/spearphishing_attachments.md +++ b/docs/_stories/spearphishing_attachments.md @@ -37,24 +37,24 @@ This Analytic Story focuses on detecting signs that a malicious payload has been | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Excel Spawning PowerShell](/endpoint/excel_spawning_powershell/) | [Security Account Manager](/tags/#security-account-manager) | TTP | -| [Excel Spawning Windows Script Host](/endpoint/excel_spawning_windows_script_host/) | [Security Account Manager](/tags/#security-account-manager) | TTP | -| [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Document Creating Schedule Task](/endpoint/office_document_creating_schedule_task/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Document Spawned Child Process To Download](/endpoint/office_document_spawned_child_process_to_download/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawning BITSAdmin](/endpoint/office_product_spawning_bitsadmin/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawning CertUtil](/endpoint/office_product_spawning_certutil/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawning MSHTA](/endpoint/office_product_spawning_mshta/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawning Rundll32 with no DLL](/endpoint/office_product_spawning_rundll32_with_no_dll/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawning Wmic](/endpoint/office_product_spawning_wmic/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Writing cab or inf](/endpoint/office_product_writing_cab_or_inf/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Spawning Control](/endpoint/office_spawning_control/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Process Creating LNK file in Suspicious Location](/endpoint/process_creating_lnk_file_in_suspicious_location/) | [Spearphishing Link](/tags/#spearphishing-link) | TTP | -| [Winword Spawning Cmd](/endpoint/winword_spawning_cmd/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Winword Spawning PowerShell](/endpoint/winword_spawning_powershell/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Excel Spawning PowerShell](/endpoint/excel_spawning_powershell/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Excel Spawning Windows Script Host](/endpoint/excel_spawning_windows_script_host/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Document Creating Schedule Task](/endpoint/office_document_creating_schedule_task/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Document Spawned Child Process To Download](/endpoint/office_document_spawned_child_process_to_download/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning BITSAdmin](/endpoint/office_product_spawning_bitsadmin/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning CertUtil](/endpoint/office_product_spawning_certutil/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning MSHTA](/endpoint/office_product_spawning_mshta/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning Rundll32 with no DLL](/endpoint/office_product_spawning_rundll32_with_no_dll/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning Wmic](/endpoint/office_product_spawning_wmic/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Writing cab or inf](/endpoint/office_product_writing_cab_or_inf/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Spawning Control](/endpoint/office_spawning_control/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Process Creating LNK file in Suspicious Location](/endpoint/process_creating_lnk_file_in_suspicious_location/) | [Phishing](/tags/#phishing), [Spearphishing Link](/tags/#spearphishing-link) | TTP | +| [Winword Spawning Cmd](/endpoint/winword_spawning_cmd/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Winword Spawning PowerShell](/endpoint/winword_spawning_powershell/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | #### Reference diff --git a/docs/_stories/suspicious_cloud_instance_activities.md b/docs/_stories/suspicious_cloud_instance_activities.md index 0eb6f09476..4d3f40bfb5 100644 --- a/docs/_stories/suspicious_cloud_instance_activities.md +++ b/docs/_stories/suspicious_cloud_instance_activities.md @@ -31,9 +31,9 @@ Monitoring your cloud infrastructure logs allows you enable governance, complian | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Abnormally High Number Of Cloud Instances Destroyed](/cloud/abnormally_high_number_of_cloud_instances_destroyed/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | -| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | -| [Cloud Instance Modified By Previously Unseen User](/cloud/cloud_instance_modified_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Instances Destroyed](/cloud/abnormally_high_number_of_cloud_instances_destroyed/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Cloud Instance Modified By Previously Unseen User](/cloud/cloud_instance_modified_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | | [Detect shared ec2 snapshot](/cloud/detect_shared_ec2_snapshot/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | TTP | #### Reference diff --git a/docs/_stories/suspicious_cloud_user_activities.md b/docs/_stories/suspicious_cloud_user_activities.md index bff4078331..34350628a8 100644 --- a/docs/_stories/suspicious_cloud_user_activities.md +++ b/docs/_stories/suspicious_cloud_user_activities.md @@ -33,8 +33,8 @@ In addition to compromising the security of your data, when bad actors leverage | Name | Technique | Type | | ----------- | ----------- |--------------| | [AWS IAM AccessDenied Discovery Events](/cloud/aws_iam_accessdenied_discovery_events/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery) | Anomaly | -| [Abnormally High Number Of Cloud Infrastructure API Calls](/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | -| [Abnormally High Number Of Cloud Security Group API Calls](/cloud/abnormally_high_number_of_cloud_security_group_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Infrastructure API Calls](/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Security Group API Calls](/cloud/abnormally_high_number_of_cloud_security_group_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | | [Cloud API Calls From Previously Unseen User Roles](/cloud/cloud_api_calls_from_previously_unseen_user_roles/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | #### Reference diff --git a/docs/_stories/suspicious_command-line_executions.md b/docs/_stories/suspicious_command-line_executions.md index db10ec080f..c8bca3ceb6 100644 --- a/docs/_stories/suspicious_command-line_executions.md +++ b/docs/_stories/suspicious_command-line_executions.md @@ -30,10 +30,10 @@ The ability to execute arbitrary commands via the Windows CLI is a primary goal | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell) | Hunting | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | -| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Windows Command Shell](/tags/#windows-command-shell) | TTP | -| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | TTP | +| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) | | Anomaly | | [Unusually Long Command Line - MLTK](/endpoint/unusually_long_command_line_-_mltk/) | | Anomaly | diff --git a/docs/_stories/suspicious_compiled_html_activity.md b/docs/_stories/suspicious_compiled_html_activity.md index 73dfaaa5af..acca03dd17 100644 --- a/docs/_stories/suspicious_compiled_html_activity.md +++ b/docs/_stories/suspicious_compiled_html_activity.md @@ -33,10 +33,10 @@ Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [Compiled HTML File](/tags/#compiled-html-file) | Hunting | -| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Compiled HTML File](/tags/#compiled-html-file) | TTP | -| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Compiled HTML File](/tags/#compiled-html-file) | TTP | -| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Compiled HTML File](/tags/#compiled-html-file) | TTP | +| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | Hunting | +| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP | +| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP | +| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP | #### Reference diff --git a/docs/_stories/suspicious_dns_traffic.md b/docs/_stories/suspicious_dns_traffic.md index 4cc8a34e6b..01df9d4326 100644 --- a/docs/_stories/suspicious_dns_traffic.md +++ b/docs/_stories/suspicious_dns_traffic.md @@ -32,10 +32,10 @@ Although DNS is one of the fundamental underlying protocols that make the Intern | Name | Technique | Type | | ----------- | ----------- |--------------| | [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | -| [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns) | Anomaly | -| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | +| [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol) | Anomaly | +| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | TTP | -| [Excessive DNS Failures](/network/excessive_dns_failures/) | [DNS](/tags/#dns) | Anomaly | +| [Excessive DNS Failures](/network/excessive_dns_failures/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol) | Anomaly | | [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | #### Reference diff --git a/docs/_stories/suspicious_emails.md b/docs/_stories/suspicious_emails.md index 4e900e0c29..6f25f48afe 100644 --- a/docs/_stories/suspicious_emails.md +++ b/docs/_stories/suspicious_emails.md @@ -36,7 +36,7 @@ Once a phishing message has been detected, the next steps are to answer the foll | ----------- | ----------- |--------------| | [Email Attachments With Lots Of Spaces](/application/email_attachments_with_lots_of_spaces/) | | Anomaly | | [Monitor Email For Brand Abuse](/application/monitor_email_for_brand_abuse/) | | TTP | -| [Suspicious Email Attachment Extensions](/application/suspicious_email_attachment_extensions/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | +| [Suspicious Email Attachment Extensions](/application/suspicious_email_attachment_extensions/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | Anomaly | #### Reference diff --git a/docs/_stories/suspicious_mshta_activity.md b/docs/_stories/suspicious_mshta_activity.md index e88c3176f4..32ab891725 100644 --- a/docs/_stories/suspicious_mshta_activity.md +++ b/docs/_stories/suspicious_mshta_activity.md @@ -42,15 +42,15 @@ The objective of this step is to confirm the executed script code is benign or m | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Mshta](/tags/#mshta) | TTP | -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell) | Hunting | +| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | -| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Mshta](/tags/#mshta) | TTP | -| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Mshta](/tags/#mshta) | TTP | -| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [Mshta](/tags/#mshta) | Hunting | -| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | -| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [Mshta](/tags/#mshta) | TTP | -| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [Mshta](/tags/#mshta) | TTP | +| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | Hunting | +| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | #### Reference diff --git a/docs/_stories/suspicious_okta_activity.md b/docs/_stories/suspicious_okta_activity.md index 86d5fe9ddf..3d769d6b1b 100644 --- a/docs/_stories/suspicious_okta_activity.md +++ b/docs/_stories/suspicious_okta_activity.md @@ -31,10 +31,10 @@ With people moving quickly to adopt web-based applications and ways to manage th | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Multiple Okta Users With Invalid Credentials From The Same IP](/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip/) | [Default Accounts](/tags/#default-accounts) | TTP | -| [Okta Account Lockout Events](/application/okta_account_lockout_events/) | [Default Accounts](/tags/#default-accounts) | Anomaly | -| [Okta Failed SSO Attempts](/application/okta_failed_sso_attempts/) | [Default Accounts](/tags/#default-accounts) | Anomaly | -| [Okta User Logins From Multiple Cities](/application/okta_user_logins_from_multiple_cities/) | [Default Accounts](/tags/#default-accounts) | Anomaly | +| [Multiple Okta Users With Invalid Credentials From The Same IP](/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip/) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | TTP | +| [Okta Account Lockout Events](/application/okta_account_lockout_events/) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | Anomaly | +| [Okta Failed SSO Attempts](/application/okta_failed_sso_attempts/) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | Anomaly | +| [Okta User Logins From Multiple Cities](/application/okta_user_logins_from_multiple_cities/) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | Anomaly | #### Reference diff --git a/docs/_stories/suspicious_regsvcs_regasm_activity.md b/docs/_stories/suspicious_regsvcs_regasm_activity.md index ed0850cb23..dfbcbf1afb 100644 --- a/docs/_stories/suspicious_regsvcs_regasm_activity.md +++ b/docs/_stories/suspicious_regsvcs_regasm_activity.md @@ -30,12 +30,12 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | -| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | -| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | -| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | -| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | -| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | #### Reference diff --git a/docs/_stories/suspicious_regsvr32_activity.md b/docs/_stories/suspicious_regsvr32_activity.md index 468b57b910..e2080cb776 100644 --- a/docs/_stories/suspicious_regsvr32_activity.md +++ b/docs/_stories/suspicious_regsvr32_activity.md @@ -30,8 +30,10 @@ One common adversary tactic is to bypass application control solutions via the r | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Regsvr32](/tags/#regsvr32) | TTP | -| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [Regsvr32](/tags/#regsvr32) | TTP | +| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | TTP | +| [Malicious InProcServer32 Modification](/endpoint/malicious_inprocserver32_modification/) | [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry) | TTP | +| [Regsvr32 Silent Param Dll Loading](/endpoint/regsvr32_silent_param_dll_loading/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | TTP | +| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | TTP | #### Reference diff --git a/docs/_stories/suspicious_rundll32_activity.md b/docs/_stories/suspicious_rundll32_activity.md index 719980c449..445e490895 100644 --- a/docs/_stories/suspicious_rundll32_activity.md +++ b/docs/_stories/suspicious_rundll32_activity.md @@ -30,17 +30,17 @@ One common adversary tactic is to bypass application control solutions via the r | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Rundll32](/tags/#rundll32) | TTP | -| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Rundll32](/tags/#rundll32) | TTP | -| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Rundll32](/tags/#rundll32) | TTP | -| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory) | TTP | -| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Rundll32](/tags/#rundll32) | Hunting | -| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Rundll32](/tags/#rundll32) | TTP | -| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Rundll32](/tags/#rundll32) | TTP | -| [Suspicious Rundll32 Rename](/endpoint/suspicious_rundll32_rename/) | [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | -| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Rundll32](/tags/#rundll32) | TTP | -| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [Rundll32](/tags/#rundll32) | TTP | -| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Rundll32](/tags/#rundll32) | TTP | +| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | Hunting | +| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 Rename](/endpoint/suspicious_rundll32_rename/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | #### Reference diff --git a/docs/_stories/suspicious_windows_registry_activities.md b/docs/_stories/suspicious_windows_registry_activities.md index d5bb596658..86a6df8f30 100644 --- a/docs/_stories/suspicious_windows_registry_activities.md +++ b/docs/_stories/suspicious_windows_registry_activities.md @@ -32,11 +32,12 @@ Attackers are developing increasingly sophisticated techniques for hijacking tar | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors) | TTP | -| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | -| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | TTP | -| [Registry Keys for Creating SHIM Databases](/endpoint/registry_keys_for_creating_shim_databases/) | [Application Shimming](/tags/#application-shimming) | TTP | +| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Registry Keys for Creating SHIM Databases](/endpoint/registry_keys_for_creating_shim_databases/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | #### Reference diff --git a/docs/_stories/suspicious_wmi_use.md b/docs/_stories/suspicious_wmi_use.md index 051927f838..3a72b51fa2 100644 --- a/docs/_stories/suspicious_wmi_use.md +++ b/docs/_stories/suspicious_wmi_use.md @@ -30,13 +30,13 @@ WMI is a Microsoft infrastructure for management data and operations on Windows | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect WMI Event Subscription Persistence](/endpoint/detect_wmi_event_subscription_persistence/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription) | TTP | +| [Detect WMI Event Subscription Persistence](/endpoint/detect_wmi_event_subscription_persistence/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | | [Process Execution via WMI](/endpoint/process_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | | [Remote Process Instantiation via WMI](/endpoint/remote_process_instantiation_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | | [Remote WMI Command Attempt](/endpoint/remote_wmi_command_attempt/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | | [Script Execution via WMI](/endpoint/script_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | | [WMI Permanent Event Subscription](/endpoint/wmi_permanent_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | -| [WMI Permanent Event Subscription - Sysmon](/endpoint/wmi_permanent_event_subscription_-_sysmon/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription) | TTP | +| [WMI Permanent Event Subscription - Sysmon](/endpoint/wmi_permanent_event_subscription_-_sysmon/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | | [WMI Temporary Event Subscription](/endpoint/wmi_temporary_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | #### Reference diff --git a/docs/_stories/suspicious_zoom_child_processes.md b/docs/_stories/suspicious_zoom_child_processes.md index f57871c652..1024cbb631 100644 --- a/docs/_stories/suspicious_zoom_child_processes.md +++ b/docs/_stories/suspicious_zoom_child_processes.md @@ -31,7 +31,7 @@ Current detections focus on finding new child processes of this application on a | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell) | Hunting | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | | [First Time Seen Child Process of Zoom](/endpoint/first_time_seen_child_process_of_zoom/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | Anomaly | diff --git a/docs/_stories/trickbot.md b/docs/_stories/trickbot.md index fc9312172c..59adc8961a 100644 --- a/docs/_stories/trickbot.md +++ b/docs/_stories/trickbot.md @@ -30,21 +30,21 @@ trickbot banking trojan campaigns targeting banks and other vertical sectors.Thi | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | TTP | -| [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP | +| [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection) | TTP | -| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Mshta](/tags/#mshta) | TTP | -| [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | -| [Office Product Spawn CMD Process](/endpoint/office_product_spawn_cmd_process/) | [Mshta](/tags/#mshta) | TTP | +| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | +| [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawn CMD Process](/endpoint/office_product_spawn_cmd_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | | [Powershell Remote Thread To Known Windows Process](/endpoint/powershell_remote_thread_to_known_windows_process/) | [Process Injection](/tags/#process-injection) | TTP | | [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | -| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | | [Trickbot Named Pipe](/endpoint/trickbot_named_pipe/) | [Process Injection](/tags/#process-injection) | TTP | -| [Wermgr Process Connecting To IP Check Web Services](/endpoint/wermgr_process_connecting_to_ip_check_web_services/) | [IP Addresses](/tags/#ip-addresses) | TTP | +| [Wermgr Process Connecting To IP Check Web Services](/endpoint/wermgr_process_connecting_to_ip_check_web_services/) | [Gather Victim Network Information](/tags/#gather-victim-network-information), [IP Addresses](/tags/#ip-addresses) | TTP | | [Wermgr Process Create Executable File](/endpoint/wermgr_process_create_executable_file/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | TTP | | [Wermgr Process Spawned CMD Or Powershell Process](/endpoint/wermgr_process_spawned_cmd_or_powershell_process/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | -| [Write Executable in SMB Share](/endpoint/write_executable_in_smb_share/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Write Executable in SMB Share](/endpoint/write_executable_in_smb_share/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | #### Reference diff --git a/docs/_stories/trusted_developer_utilities_proxy_execution.md b/docs/_stories/trusted_developer_utilities_proxy_execution.md index 927fb15e23..f10fddc439 100644 --- a/docs/_stories/trusted_developer_utilities_proxy_execution.md +++ b/docs/_stories/trusted_developer_utilities_proxy_execution.md @@ -31,7 +31,7 @@ The searches in this story help you detect and investigate suspicious activity t | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | | [Suspicious microsoft workflow compiler usage](/endpoint/suspicious_microsoft_workflow_compiler_usage/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP | #### Reference diff --git a/docs/_stories/trusted_developer_utilities_proxy_execution_msbuild.md b/docs/_stories/trusted_developer_utilities_proxy_execution_msbuild.md index 30cc38c193..1494782a0f 100644 --- a/docs/_stories/trusted_developer_utilities_proxy_execution_msbuild.md +++ b/docs/_stories/trusted_developer_utilities_proxy_execution_msbuild.md @@ -43,9 +43,10 @@ The objective of this step is to confirm the executed script code is benign or m | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | -| [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [MSBuild](/tags/#msbuild) | TTP | -| [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [MSBuild Suspicious Spawned By Script Process](/endpoint/msbuild_suspicious_spawned_by_script_process/) | [MSBuild](/tags/#msbuild), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP | +| [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP | +| [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild) | TTP | +| [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP | #### Reference diff --git a/docs/_stories/unusual_processes.md b/docs/_stories/unusual_processes.md index 359310e8cd..537355d6cb 100644 --- a/docs/_stories/unusual_processes.md +++ b/docs/_stories/unusual_processes.md @@ -32,7 +32,7 @@ In the event an unusual process is identified, it is imperative to better unders | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning) | TTP | | [Credential Extraction indicative of FGDump and CacheDump with s option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of FGDump and CacheDump with v option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of use of Mimikatz modules](/endpoint/credential_extraction_indicative_of_use_of_mimikatz_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | @@ -43,12 +43,16 @@ In the event an unusual process is identified, it is imperative to better unders | [First time seen command line argument](/endpoint/first_time_seen_command_line_argument/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution) | Anomaly | | [More than usual number of LOLBAS applications in short time period](/endpoint/more_than_usual_number_of_lolbas_applications_in_short_time_period/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly | | [Rare Parent-Child Process Relationship](/endpoint/rare_parent-child_process_relationship/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job), [Software Deployment Tools](/tags/#software-deployment-tools) | Anomaly | -| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Rundll32](/tags/#rundll32) | TTP | -| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 Shimcache Flush](/endpoint/rundll32_shimcache_flush/) | [Modify Registry](/tags/#modify-registry) | TTP | +| [Suspicious Copy on System32](/endpoint/suspicious_copy_on_system32/) | [Rename System Utilities](/tags/#rename-system-utilities), [Masquerading](/tags/#masquerading) | TTP | +| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) | | Anomaly | | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) | | Anomaly | | [Unusually Long Command Line - MLTK](/endpoint/unusually_long_command_line_-_mltk/) | | Anomaly | +| [Verclsid CLSID Execution](/endpoint/verclsid_clsid_execution/) | [Verclsid](/tags/#verclsid), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | Hunting | | [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Wscript Or Cscript Suspicious Child Process](/endpoint/wscript_or_cscript_suspicious_child_process/) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | TTP | #### Reference diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md index 9054a39c77..8361d5b752 100644 --- a/docs/_stories/windows_defense_evasion_tactics.md +++ b/docs/_stories/windows_defense_evasion_tactics.md @@ -30,32 +30,34 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Disable Registry Tool](/endpoint/disable_registry_tool/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling CMD Application](/endpoint/disabling_cmd_application/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling ControlPanel](/endpoint/disabling_controlpanel/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling Firewall with Netsh](/endpoint/disabling_firewall_with_netsh/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling FolderOptions Windows Feature](/endpoint/disabling_folderoptions_windows_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling NoRun Windows App](/endpoint/disabling_norun_windows_app/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling Task Manager](/endpoint/disabling_task_manager/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [Excessive number of service control start as disabled](/endpoint/excessive_number_of_service_control_start_as_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | Anomaly | -| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP | -| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [Disable Registry Tool](/endpoint/disable_registry_tool/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disable Security Logs Using MiniNt Registry](/endpoint/disable_security_logs_using_minint_registry/) | [Modify Registry](/tags/#modify-registry) | TTP | +| [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hide Artifacts](/tags/#hide-artifacts), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling CMD Application](/endpoint/disabling_cmd_application/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling ControlPanel](/endpoint/disabling_controlpanel/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling Firewall with Netsh](/endpoint/disabling_firewall_with_netsh/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling FolderOptions Windows Feature](/endpoint/disabling_folderoptions_windows_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling NoRun Windows App](/endpoint/disabling_norun_windows_app/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Disabling Task Manager](/endpoint/disabling_task_manager/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Excessive number of service control start as disabled](/endpoint/excessive_number_of_service_control_start_as_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | Anomaly | +| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP | +| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry) | TTP | | [System Process Running from Unexpected Location](/endpoint/system_process_running_from_unexpected_location/) | [Masquerading](/tags/#masquerading) | Anomaly | -| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | -| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | #### Reference diff --git a/docs/_stories/windows_discovery_techniques.md b/docs/_stories/windows_discovery_techniques.md index cf75442434..d0d3686229 100644 --- a/docs/_stories/windows_discovery_techniques.md +++ b/docs/_stories/windows_discovery_techniques.md @@ -35,14 +35,14 @@ Attackers may not have much if any insight into their target's environment befor | [Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules](/endpoint/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules/) | [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning) | TTP | | [Reconnaissance and Access to Computers and Domains via PowerSploit modules](/endpoint/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Account Discovery](/tags/#account-discovery) | TTP | | [Reconnaissance and Access to Computers via Mimikatz modules](/endpoint/reconnaissance_and_access_to_computers_via_mimikatz_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP | -| [Reconnaissance and Access to Operating System Elements via PowerSploit modules](/endpoint/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules/) | [System Service Discovery](/tags/#system-service-discovery), [Query Registry](/tags/#query-registry), [Network Service Scanning](/tags/#network-service-scanning), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software Discovery](/tags/#software-discovery), [Software](/tags/#software) | TTP | +| [Reconnaissance and Access to Operating System Elements via PowerSploit modules](/endpoint/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules/) | [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software](/tags/#software), [Network Service Scanning](/tags/#network-service-scanning), [Query Registry](/tags/#query-registry), [System Service Discovery](/tags/#system-service-discovery), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Software Discovery](/tags/#software-discovery) | TTP | | [Reconnaissance and Access to Processes and Services via Mimikatz modules](/endpoint/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules/) | [System Service Discovery](/tags/#system-service-discovery), [Network Service Scanning](/tags/#network-service-scanning), [Process Discovery](/tags/#process-discovery) | TTP | -| [Reconnaissance and Access to Shared Resources via Mimikatz modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | TTP | -| [Reconnaissance and Access to Shared Resources via PowerSploit modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_powersploit_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | TTP | +| [Reconnaissance and Access to Shared Resources via Mimikatz modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Reconnaissance and Access to Shared Resources via PowerSploit modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | | [Reconnaissance of Access and Persistence Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | -| [Reconnaissance of Connectivity via PowerSploit modules](/endpoint/reconnaissance_of_connectivity_via_powersploit_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | TTP | -| [Reconnaissance of Credential Stores and Services via Mimikatz modules](/endpoint/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules/) | [Credentials](/tags/#credentials), [Domain Properties](/tags/#domain-properties), [Network Trust Dependencies](/tags/#network-trust-dependencies), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | -| [Reconnaissance of Defensive Tools via PowerSploit modules](/endpoint/reconnaissance_of_defensive_tools_via_powersploit_modules/) | [Vulnerability Scanning](/tags/#vulnerability-scanning), [Software](/tags/#software) | TTP | +| [Reconnaissance of Connectivity via PowerSploit modules](/endpoint/reconnaissance_of_connectivity_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Network Share Discovery](/tags/#network-share-discovery), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Reconnaissance of Credential Stores and Services via Mimikatz modules](/endpoint/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules/) | [Account Manipulation](/tags/#account-manipulation), [Domain Properties](/tags/#domain-properties), [Valid Accounts](/tags/#valid-accounts), [Credentials](/tags/#credentials), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Gather Victim Identity Information](/tags/#gather-victim-identity-information), [Network Trust Dependencies](/tags/#network-trust-dependencies) | TTP | +| [Reconnaissance of Defensive Tools via PowerSploit modules](/endpoint/reconnaissance_of_defensive_tools_via_powersploit_modules/) | [Software](/tags/#software), [Vulnerability Scanning](/tags/#vulnerability-scanning), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Active Scanning](/tags/#active-scanning) | TTP | | [Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | | [Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules](/endpoint/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | diff --git a/docs/_stories/windows_file_extension_and_association_abuse.md b/docs/_stories/windows_file_extension_and_association_abuse.md index 7182428ee0..5120875c71 100644 --- a/docs/_stories/windows_file_extension_and_association_abuse.md +++ b/docs/_stories/windows_file_extension_and_association_abuse.md @@ -34,7 +34,7 @@ Run the searches in this story to detect and investigate suspicious behavior tha | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | #### Reference diff --git a/docs/_stories/windows_log_manipulation.md b/docs/_stories/windows_log_manipulation.md index 3730051e98..cb1be485de 100644 --- a/docs/_stories/windows_log_manipulation.md +++ b/docs/_stories/windows_log_manipulation.md @@ -33,12 +33,12 @@ The Analytic Story gives users two different ways to detect manipulation of Wind | ----------- | ----------- |--------------| | [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Illegal Deletion of Logs via Mimikatz modules](/endpoint/illegal_deletion_of_logs_via_mimikatz_modules/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | -| [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | | [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | -| [WevtUtil Usage To Clear Logs](/endpoint/wevtutil_usage_to_clear_logs/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [Wevtutil Usage To Disable Logs](/endpoint/wevtutil_usage_to_disable_logs/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | -| [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [WevtUtil Usage To Clear Logs](/endpoint/wevtutil_usage_to_clear_logs/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Wevtutil Usage To Disable Logs](/endpoint/wevtutil_usage_to_disable_logs/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | #### Reference diff --git a/docs/_stories/windows_persistence_techniques.md b/docs/_stories/windows_persistence_techniques.md index f83b173379..b74de5fd92 100644 --- a/docs/_stories/windows_persistence_techniques.md +++ b/docs/_stories/windows_persistence_techniques.md @@ -30,30 +30,37 @@ Maintaining persistence is one of the first steps taken by attackers after the i | Name | Technique | Type | | ----------- | ----------- |--------------| +| [Active Setup Registry Autostart](/endpoint/active_setup_registry_autostart/) | [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Certutil exe certificate extraction](/endpoint/certutil_exe_certificate_extraction/) | | TTP | -| [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path) | TTP | -| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP | +| [Change Default File Association](/endpoint/change_default_file_association/) | [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | +| [ETW Registry Disabled](/endpoint/etw_registry_disabled/) | [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP | | [Illegal Account Creation via PowerSploit modules](/endpoint/illegal_account_creation_via_powersploit_modules/) | [Establish Accounts](/tags/#establish-accounts) | TTP | | [Illegal Enabling or Disabling of Accounts via DSInternals modules](/endpoint/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | | [Illegal Management of Active Directory Elements and Policies via DSInternals modules](/endpoint/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules/) | [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP | | [Illegal Management of Computers and Active Directory Elements via PowerSploit modules](/endpoint/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules/) | [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP | | [Illegal Privilege Elevation and Persistence via PowerSploit modules](/endpoint/illegal_privilege_elevation_and_persistence_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | -| [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors) | TTP | -| [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | TTP | -| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | -| [Registry Keys for Creating SHIM Databases](/endpoint/registry_keys_for_creating_shim_databases/) | [Application Shimming](/tags/#application-shimming) | TTP | -| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | TTP | +| [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP | +| [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Print Processor Registry Autostart](/endpoint/print_processor_registry_autostart/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | +| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Registry Keys for Creating SHIM Databases](/endpoint/registry_keys_for_creating_shim_databases/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Schedule Task with HTTP Command Arguments](/endpoint/schedule_task_with_http_command_arguments/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | | [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | -| [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [Screensaver Event Trigger Execution](/endpoint/screensaver_event_trigger_execution/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Screensaver](/tags/#screensaver) | TTP | | [Setting Credentials via DSInternals modules](/endpoint/setting_credentials_via_dsinternals_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | | [Setting Credentials via Mimikatz modules](/endpoint/setting_credentials_via_mimikatz_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | | [Setting Credentials via PowerSploit modules](/endpoint/setting_credentials_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | -| [Shim Database File Creation](/endpoint/shim_database_file_creation/) | [Application Shimming](/tags/#application-shimming) | TTP | -| [Shim Database Installation With Suspicious Parameters](/endpoint/shim_database_installation_with_suspicious_parameters/) | [Application Shimming](/tags/#application-shimming) | TTP | -| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task) | Anomaly | -| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task) | TTP | -| [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [Shim Database File Creation](/endpoint/shim_database_file_creation/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Shim Database Installation With Suspicious Parameters](/endpoint/shim_database_installation_with_suspicious_parameters/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly | +| [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | #### Reference diff --git a/docs/_stories/windows_privilege_escalation.md b/docs/_stories/windows_privilege_escalation.md index 5f3c6562bd..37a0550cc8 100644 --- a/docs/_stories/windows_privilege_escalation.md +++ b/docs/_stories/windows_privilege_escalation.md @@ -30,11 +30,18 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain | Name | Technique | Type | | ----------- | ----------- |--------------| +| [Active Setup Registry Autostart](/endpoint/active_setup_registry_autostart/) | [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | +| [Change Default File Association](/endpoint/change_default_file_association/) | [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | | [Child Processes of Spoolsv exe](/endpoint/child_processes_of_spoolsv_exe/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | +| [ETW Registry Disabled](/endpoint/etw_registry_disabled/) | [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Illegal Privilege Elevation via Mimikatz modules](/endpoint/illegal_privilege_elevation_via_mimikatz_modules/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | -| [Overwriting Accessibility Binaries](/endpoint/overwriting_accessibility_binaries/) | [Accessibility Features](/tags/#accessibility-features) | TTP | +| [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP | +| [Overwriting Accessibility Binaries](/endpoint/overwriting_accessibility_binaries/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Accessibility Features](/tags/#accessibility-features) | TTP | +| [Print Processor Registry Autostart](/endpoint/print_processor_registry_autostart/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | | [Probing Access with Stolen Credentials via PowerSploit modules](/endpoint/probing_access_with_stolen_credentials_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | -| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | TTP | +| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP | +| [Screensaver Event Trigger Execution](/endpoint/screensaver_event_trigger_execution/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Screensaver](/tags/#screensaver) | TTP | +| [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP | #### Reference diff --git a/docs/_stories/windows_service_abuse.md b/docs/_stories/windows_service_abuse.md index cb0820168a..01821b3d60 100644 --- a/docs/_stories/windows_service_abuse.md +++ b/docs/_stories/windows_service_abuse.md @@ -30,11 +30,11 @@ The Windows operating system uses a services architecture to allow for running c | Name | Technique | Type | | ----------- | ----------- |--------------| -| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution) | Anomaly | +| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly | | [Illegal Service and Process Control via Mimikatz modules](/endpoint/illegal_service_and_process_control_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP | | [Illegal Service and Process Control via PowerSploit modules](/endpoint/illegal_service_and_process_control_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP | -| [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | TTP | -| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | TTP | +| [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | +| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | #### Reference diff --git a/docs/_stories/xmrig.md b/docs/_stories/xmrig.md index 0791d66d3e..a8a2207afa 100644 --- a/docs/_stories/xmrig.md +++ b/docs/_stories/xmrig.md @@ -30,14 +30,14 @@ XMRig is a high performance, open source, cross platform RandomX, KawPow, Crypto | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning) | TTP | | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP | | [Attempt To delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop) | TTP | | [Delete A Net User](/endpoint/delete_a_net_user/) | [Service Stop](/tags/#service-stop) | Anomaly | | [Deleting Of Net Users](/endpoint/deleting_of_net_users/) | [Account Access Removal](/tags/#account-access-removal) | TTP | | [Deny Permission using Cacls Utility](/endpoint/deny_permission_using_cacls_utility/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | | [Disable Net User Account](/endpoint/disable_net_user_account/) | [Service Stop](/tags/#service-stop) | TTP | -| [Disable Windows App Hotkeys](/endpoint/disable_windows_app_hotkeys/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disable Windows App Hotkeys](/endpoint/disable_windows_app_hotkeys/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Disabling Net User Account](/endpoint/disabling_net_user_account/) | [Account Access Removal](/tags/#account-access-removal) | TTP | | [Download Files Using Telegram](/endpoint/download_files_using_telegram/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [Enumerate Users Local Group Using Telegram](/endpoint/enumerate_users_local_group_using_telegram/) | [Account Discovery](/tags/#account-discovery) | TTP | @@ -45,19 +45,19 @@ XMRig is a high performance, open source, cross platform RandomX, KawPow, Crypto | [Excessive Service Stop Attempt](/endpoint/excessive_service_stop_attempt/) | [Service Stop](/tags/#service-stop) | Anomaly | | [Excessive Usage Of Cacls App](/endpoint/excessive_usage_of_cacls_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | Anomaly | | [Excessive Usage Of Net App](/endpoint/excessive_usage_of_net_app/) | [Account Access Removal](/tags/#account-access-removal) | Anomaly | -| [Excessive Usage Of Taskkill](/endpoint/excessive_usage_of_taskkill/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | Anomaly | +| [Excessive Usage Of Taskkill](/endpoint/excessive_usage_of_taskkill/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | Anomaly | | [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading) | TTP | | [Grant Permission Using Cacls Utility](/endpoint/grant_permission_using_cacls_utility/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | -| [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [ICACLS Grant Command](/endpoint/icacls_grant_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | | [Icacls Deny Command](/endpoint/icacls_deny_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | | [Modify ACL permission To Files Or Folder](/endpoint/modify_acl_permission_to_files_or_folder/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | | [Modify ACLs Permission Of Files Or Folders](/endpoint/modify_acls_permission_of_files_or_folders/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | Anomaly | -| [Process Kill Base On File Path](/endpoint/process_kill_base_on_file_path/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Process Kill Base On File Path](/endpoint/process_kill_base_on_file_path/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Schtasks Run Task On Demand](/endpoint/schtasks_run_task_on_demand/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | -| [Suspicious Driver Loaded Path](/endpoint/suspicious_driver_loaded_path/) | [Windows Service](/tags/#windows-service) | TTP | +| [Suspicious Driver Loaded Path](/endpoint/suspicious_driver_loaded_path/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | -| [XMRIG Driver Loaded](/endpoint/xmrig_driver_loaded/) | [Windows Service](/tags/#windows-service) | TTP | +| [XMRIG Driver Loaded](/endpoint/xmrig_driver_loaded/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | #### Reference diff --git a/docs/detections.wiki b/docs/detections.wiki index 8dad067eaf..3b9e670302 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -144,7 +144,7 @@ The search looks at the change-analysis data model and detects email files creat * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/001/ T1114.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114/001/ T1114.001] * '''Last Updated''': 2020-07-21
@@ -188,6 +188,10 @@ To successfully implement this search, you must be ingesting data that records t ! Technique ! Tactic |- +| T1114 +| Email Collection +| Collection +|- | T1114.001 | Local Email Collection | Collection @@ -219,7 +223,7 @@ This search looks for an increase of data transfers from your email server to yo * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/002/ T1114.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114/002/ T1114.002] * '''Last Updated''': 2020-07-21
@@ -265,6 +269,10 @@ This search requires you to be ingesting your network traffic and populating the ! Technique ! Tactic |- +| T1114 +| Email Collection +| Collection +|- | T1114.002 | Remote Email Collection | Collection @@ -363,7 +371,7 @@ This search detects Okta login failures due to bad credentials for multiple user * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/001/ T1078.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1078/001/ T1078.001] * '''Last Updated''': 2020-07-21
@@ -412,6 +420,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you ! Technique ! Tactic |- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- | T1078.001 | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access @@ -504,7 +516,7 @@ Detect Okta user lockout events * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/001/ T1078.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1078/001/ T1078.001] * '''Last Updated''': 2020-07-21
@@ -544,6 +556,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you ! Technique ! Tactic |- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- | T1078.001 | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access @@ -573,7 +589,7 @@ Detect failed Okta SSO events * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/001/ T1078.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1078/001/ T1078.001] * '''Last Updated''': 2020-07-21
@@ -616,6 +632,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you ! Technique ! Tactic |- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- | T1078.001 | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access @@ -645,7 +665,7 @@ This search detects logins from the same user from different cities in a 24 hour * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/001/ T1078.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1078/001/ T1078.001] * '''Last Updated''': 2020-07-21
@@ -687,6 +707,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you ! Technique ! Tactic |- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- | T1078.001 | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access @@ -783,7 +807,7 @@ This search looks for emails that have attachments with suspicious file extensio * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Email -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001], [https://attack.mitre.org/techniques/T1566/ T1566] * '''Last Updated''': 2020-07-22
@@ -831,6 +855,10 @@ If Splunk Phantom is also configured in your environment, a Playbook called " | T1566.001 | Spearphishing Attachment | Initial Access +|- +| T1566 +| Phishing +| Initial Access |} @@ -1011,7 +1039,7 @@ This search looks for AWS CloudTrail events where a user created a policy versio * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004], [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2021-02-22
@@ -1059,6 +1087,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -1095,7 +1127,7 @@ This search looks for AWS CloudTrail events where a user A who has already permi * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003], [https://attack.mitre.org/techniques/T1136/ T1136] * '''Last Updated''': 2021-07-19
@@ -1140,6 +1172,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | T1136.003 | Cloud Account | Persistence +|- +| T1136 +| Create Account +| Persistence |} @@ -1176,7 +1212,7 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003], [https://attack.mitre.org/techniques/T1136/ T1136] * '''Last Updated''': 2021-07-19
@@ -1225,6 +1261,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | T1136.003 | Cloud Account | Persistence +|- +| T1136 +| Create Account +| Persistence |} @@ -1511,7 +1551,7 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003], [https://attack.mitre.org/techniques/T1204/ T1204] * '''Last Updated''': 2021-08-17
@@ -1571,6 +1611,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | T1204.003 | Malicious Image | Execution +|- +| T1204 +| User Execution +| Execution |} @@ -1603,7 +1647,7 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003], [https://attack.mitre.org/techniques/T1204/ T1204] * '''Last Updated''': 2021-08-17
@@ -1663,6 +1707,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | T1204.003 | Malicious Image | Execution +|- +| T1204 +| User Execution +| Execution |} @@ -1695,7 +1743,7 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003], [https://attack.mitre.org/techniques/T1204/ T1204] * '''Last Updated''': 2021-08-17
@@ -1755,6 +1803,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | T1204.003 | Malicious Image | Execution +|- +| T1204 +| User Execution +| Execution |} @@ -1787,7 +1839,7 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003], [https://attack.mitre.org/techniques/T1204/ T1204] * '''Last Updated''': 2021-08-19
@@ -1843,6 +1895,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | T1204.003 | Malicious Image | Execution +|- +| T1204 +| User Execution +| Execution |} @@ -1875,7 +1931,7 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003], [https://attack.mitre.org/techniques/T1204/ T1204] * '''Last Updated''': 2021-08-19
@@ -1931,6 +1987,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | T1204.003 | Malicious Image | Execution +|- +| T1204 +| User Execution +| Execution |} @@ -2373,7 +2433,7 @@ The following query uses IAM events to track the success of a group being delete * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Splunk Security Analytics for AWS * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/003/ T1069.003], [https://attack.mitre.org/techniques/T1098/ T1098] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/003/ T1069.003], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1069/ T1069] * '''Last Updated''': 2021-03-31
@@ -2421,6 +2481,10 @@ The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. T | T1098 | Account Manipulation | Persistence +|- +| T1069 +| Permission Groups Discovery +| Discovery |} @@ -2457,7 +2521,7 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-01-11
@@ -2517,6 +2581,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add- | T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -2547,7 +2615,7 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-01-12
@@ -2596,6 +2664,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add- | T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -2804,7 +2876,7 @@ This search looks for AWS CloudTrail events where a user has set a default polic * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004], [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2021-03-02
@@ -2850,6 +2922,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -2886,7 +2962,7 @@ This search looks for AWS CloudTrail events where a user A who has already permi * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003], [https://attack.mitre.org/techniques/T1136/ T1136] * '''Last Updated''': 2021-07-19
@@ -2931,6 +3007,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit | T1136.003 | Cloud Account | Persistence +|- +| T1136 +| Create Account +| Persistence |} @@ -2967,7 +3047,7 @@ This search will detect a spike in the number of API calls made to your cloud in * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004], [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-09-07
@@ -3021,6 +3101,10 @@ You must be ingesting your cloud infrastructure logs. You also must run the base | T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3051,7 +3135,7 @@ This search finds for the number successfully destroyed cloud instances for ever * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004], [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-08-21
@@ -3108,6 +3192,10 @@ You must be ingesting your cloud infrastructure logs. You also must run the base | T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3136,7 +3224,7 @@ This search finds for the number successfully created cloud instances for every * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004], [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-08-21
@@ -3195,6 +3283,10 @@ You must be ingesting your cloud infrastructure logs. You also must run the base | T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3223,7 +3315,7 @@ This search will detect a spike in the number of API calls made to your cloud in * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004], [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-09-07
@@ -3279,6 +3371,10 @@ You must be ingesting your cloud infrastructure logs. You also must run the base | T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -3712,7 +3808,7 @@ This search looks for cloud compute instances created by users who have not crea * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004], [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2021-07-13
@@ -3762,6 +3858,10 @@ You must be ingesting the appropriate cloud-infrastructure logs Run the "Pre | T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -4008,7 +4108,7 @@ This search looks for cloud instances being modified by users who have not previ * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/004/ T1078.004], [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-07-29
@@ -4062,6 +4162,10 @@ This search has a dependency on other searches to create and update a baseline o | T1078.004 | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access |} @@ -4428,7 +4532,7 @@ This search correlations detections by repository and risk_score * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003], [https://attack.mitre.org/techniques/T1204/ T1204] * '''Last Updated''': 2021-09-06
@@ -4465,6 +4569,10 @@ For Dev Sec Ops POC | T1204.003 | Malicious Image | Execution +|- +| T1204 +| User Execution +| Execution |} @@ -4493,7 +4601,7 @@ This search correlations detections by user and risk_score * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003], [https://attack.mitre.org/techniques/T1204/ T1204] * '''Last Updated''': 2021-09-06
@@ -4530,6 +4638,10 @@ For Dev Sec Ops POC | T1204.003 | Malicious Image | Execution +|- +| T1204 +| User Execution +| Execution |} @@ -5859,7 +5971,7 @@ This search is to detect a suspicious attachment file extension in Gsuite email * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001], [https://attack.mitre.org/techniques/T1566/ T1566] * '''Last Updated''': 2021-08-16
@@ -5876,7 +5988,7 @@ This search is to detect a suspicious attachment file extension in Gsuite email ====Associated Analytic Story==== -* [[Documentation:ESSOC:stories:UseCase#DevSecOps|DevSecOps]] +* [[Documentation:ESSOC:stories:UseCase#Dev_Sec_Ops|Dev Sec Ops]] ====How To Implement==== @@ -5913,6 +6025,10 @@ To successfully implement this search, you need to be ingesting logs related to | T1566.001 | Spearphishing Attachment | Initial Access +|- +| T1566 +| Phishing +| Initial Access |} @@ -5947,7 +6063,7 @@ This search looks for Dependabot Alerts in Github logs. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1195/001/ T1195.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1195/001/ T1195.001], [https://attack.mitre.org/techniques/T1195/ T1195] * '''Last Updated''': 2021-09-01
@@ -6007,6 +6123,10 @@ You must index GitHub logs. You can follow the url in reference to onboard GitHu | T1195.001 | Compromise Software Dependencies and Development Tools | Initial Access +|- +| T1195 +| Supply Chain Compromise +| Initial Access |} @@ -6041,7 +6161,7 @@ This search looks for Pull Request from unknown user. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1195/001/ T1195.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1195/001/ T1195.001], [https://attack.mitre.org/techniques/T1195/ T1195] * '''Last Updated''': 2021-09-01
@@ -6102,6 +6222,10 @@ You must index GitHub logs. You can follow the url in reference to onboard GitHu | T1195.001 | Compromise Software Dependencies and Development Tools | Initial Access +|- +| T1195 +| Supply Chain Compromise +| Initial Access |} @@ -6154,7 +6278,7 @@ This search is to detect a pushed or commit to master or main branch. This is to ====Associated Analytic Story==== -* [[Documentation:ESSOC:stories:UseCase#DevSecOps|DevSecOps]] +* [[Documentation:ESSOC:stories:UseCase#Dev_Sec_Ops|Dev Sec Ops]] ====How To Implement==== @@ -6225,7 +6349,7 @@ This search is to detect a pushed or commit to develop branch. This is to avoid ====Associated Analytic Story==== -* [[Documentation:ESSOC:stories:UseCase#DevSecOps|DevSecOps]] +* [[Documentation:ESSOC:stories:UseCase#Dev_Sec_Ops|Dev Sec Ops]] ====How To Implement==== @@ -6280,7 +6404,7 @@ This search is to detect suspicious google drive or google docs files shared out * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1567/002/ T1567.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1567/002/ T1567.002], [https://attack.mitre.org/techniques/T1567/ T1567] * '''Last Updated''': 2021-08-16
@@ -6301,11 +6425,11 @@ This search is to detect suspicious google drive or google docs files shared out ====Associated Analytic Story==== -* [[Documentation:ESSOC:stories:UseCase#DevSecOps|DevSecOps]] +* [[Documentation:ESSOC:stories:UseCase#Dev_Sec_Ops|Dev Sec Ops]] ====How To Implement==== -To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. +To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. ====Required field==== @@ -6336,6 +6460,10 @@ To successfully implement this search, you need to be ingesting logs related to | T1567.002 | Exfiltration to Cloud Storage | Exfiltration +|- +| T1567 +| Exfiltration Over Web Service +| Exfiltration |} @@ -6370,7 +6498,7 @@ This search is to detect a gsuite email contains suspicious subject having known * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001], [https://attack.mitre.org/techniques/T1566/ T1566] * '''Last Updated''': 2021-08-19
@@ -6390,7 +6518,7 @@ This search is to detect a gsuite email contains suspicious subject having known ====Associated Analytic Story==== -* [[Documentation:ESSOC:stories:UseCase#DevSecOps|DevSecOps]] +* [[Documentation:ESSOC:stories:UseCase#Dev_Sec_Ops|Dev Sec Ops]] ====How To Implement==== @@ -6411,6 +6539,10 @@ To successfully implement this search, you need to be ingesting logs related to | T1566.001 | Spearphishing Attachment | Initial Access +|- +| T1566 +| Phishing +| Initial Access |} @@ -6447,7 +6579,7 @@ This analytics is to detect a gmail containing a link that are known to be abuse * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001], [https://attack.mitre.org/techniques/T1566/ T1566] * '''Last Updated''': 2021-08-23
@@ -6467,7 +6599,7 @@ This analytics is to detect a gmail containing a link that are known to be abuse ====Associated Analytic Story==== -* [[Documentation:ESSOC:stories:UseCase#DevSecOps|DevSecOps]] +* [[Documentation:ESSOC:stories:UseCase#Dev_Sec_Ops|Dev Sec Ops]] ====How To Implement==== @@ -6488,6 +6620,10 @@ To successfully implement this search, you need to be ingesting logs related to | T1566.001 | Spearphishing Attachment | Initial Access +|- +| T1566 +| Phishing +| Initial Access |} @@ -6522,7 +6658,7 @@ This search is to detect a suspicious outbound e-mail from internal email to ext * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003], [https://attack.mitre.org/techniques/T1048/ T1048] * '''Last Updated''': 2021-08-17
@@ -6544,7 +6680,7 @@ This search is to detect a suspicious outbound e-mail from internal email to ext ====Associated Analytic Story==== -* [[Documentation:ESSOC:stories:UseCase#DevSecOps|DevSecOps]] +* [[Documentation:ESSOC:stories:UseCase#Dev_Sec_Ops|Dev Sec Ops]] ====How To Implement==== @@ -6565,6 +6701,10 @@ To successfully implement this search, you need to be ingesting logs related to | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration +|- +| T1048 +| Exfiltration Over Alternative Protocol +| Exfiltration |} @@ -6599,7 +6739,7 @@ This search is to detect a shared file in google drive with suspicious file name * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud, Dev Sec Ops Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001], [https://attack.mitre.org/techniques/T1566/ T1566] * '''Last Updated''': 2021-08-23
@@ -6620,11 +6760,11 @@ This search is to detect a shared file in google drive with suspicious file name ====Associated Analytic Story==== -* [[Documentation:ESSOC:stories:UseCase#DevSecOps|DevSecOps]] +* [[Documentation:ESSOC:stories:UseCase#Dev_Sec_Ops|Dev Sec Ops]] ====How To Implement==== -To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. +To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. ====Required field==== @@ -6655,6 +6795,10 @@ To successfully implement this search, you need to be ingesting logs related to | T1566.001 | Spearphishing Attachment | Initial Access +|- +| T1566 +| Phishing +| Initial Access |} @@ -6691,7 +6835,7 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/001/ T1110.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/001/ T1110.001], [https://attack.mitre.org/techniques/T1110/ T1110] * '''Last Updated''': 2020-12-16
@@ -6746,6 +6890,10 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir | T1110.001 | Password Guessing | Credential Access +|- +| T1110 +| Brute Force +| Credential Access |} @@ -7144,7 +7292,7 @@ This search detects the creation of a new Federation setting by alerting about a * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003], [https://attack.mitre.org/techniques/T1136/ T1136] * '''Last Updated''': 2021-01-26
@@ -7196,6 +7344,10 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 | T1136.003 | Cloud Account | Persistence +|- +| T1136 +| Create Account +| Persistence |} @@ -7232,7 +7384,7 @@ This search detects the creation of a new Federation setting by alerting about a * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003], [https://attack.mitre.org/techniques/T1136/ T1136] * '''Last Updated''': 2021-01-26
@@ -7284,6 +7436,10 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 | T1136.003 | Cloud Account | Persistence +|- +| T1136 +| Create Account +| Persistence |} @@ -7324,7 +7480,7 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-07-19
@@ -7383,6 +7539,10 @@ You must install Splunk Microsoft Office 365 add-on. This search works with o365 | T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -7669,7 +7829,7 @@ This search detects the addition of a new Federated domain. * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/003/ T1136.003], [https://attack.mitre.org/techniques/T1136/ T1136] * '''Last Updated''': 2021-01-26
@@ -7723,6 +7883,10 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 | T1136.003 | Cloud Account | Persistence +|- +| T1136 +| Create Account +| Persistence |} @@ -7849,7 +8013,7 @@ This search detects when an admin configured a forwarding rule for multiple mail * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/003/ T1114.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/003/ T1114.003], [https://attack.mitre.org/techniques/T1114/ T1114] * '''Last Updated''': 2020-12-16
@@ -7895,6 +8059,10 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 | T1114.003 | Email Forwarding Rule | Collection +|- +| T1114 +| Email Collection +| Collection |} @@ -7925,7 +8093,7 @@ This search detects the assignment of rights to accesss content from another mai * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/002/ T1114.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/002/ T1114.002], [https://attack.mitre.org/techniques/T1114/ T1114] * '''Last Updated''': 2020-12-15
@@ -7968,6 +8136,10 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 | T1114.002 | Remote Email Collection | Collection +|- +| T1114 +| Email Collection +| Collection |} @@ -7998,7 +8170,7 @@ This search detects when multiple user configured a forwarding rule to the same * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/003/ T1114.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/003/ T1114.003], [https://attack.mitre.org/techniques/T1114/ T1114] * '''Last Updated''': 2020-12-16
@@ -8044,6 +8216,10 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365 | T1114.003 | Email Forwarding Rule | Collection +|- +| T1114 +| Email Collection +| Collection |} @@ -8492,7 +8668,7 @@ This search is to detect a suspicious 7z process with commandline pointing to SM * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001], [https://attack.mitre.org/techniques/T1560/ T1560] * '''Last Updated''': 2021-08-17
@@ -8545,6 +8721,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1560.001 | Archive via Utility | Collection +|- +| T1560 +| Archive Collected Data +| Collection |} @@ -8579,7 +8759,7 @@ Detect memory dumping of the LSASS process. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2019-12-06
@@ -8630,6 +8810,10 @@ This search requires Sysmon Logs and a Sysmon configuration, which includes Even | T1003.001 | LSASS Memory | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -8664,7 +8848,7 @@ this search is to detect a potential account discovery series of command used by * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-09-16
@@ -8726,6 +8910,10 @@ To successfully implement this search you need to be ingesting information on pr | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -8759,12 +8947,101 @@ admin or power user may used this series of command. ---- +===Active setup registry autostart=== +This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine upon boot up. This TTP is a good indicator to further check the process id that do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/014/ T1547.014], [https://attack.mitre.org/techniques/T1547/ T1547] +* '''Last Updated''': 2021-09-28 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `active_setup_registry_autostart_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Privilege_Escalation|Windows Privilege Escalation]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +====Required field==== + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_path + +* Registry.registry_key_name + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1547.014 +| Active Setup +| Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Active setup installer may add or modify this registry. + +====Reference==== + + +* https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E + +* https://attack.mitre.org/techniques/T1547/014/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log + + +''version'': 1 +
+
+ +---- + ===Add defaultuser and password in registry=== this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1552/002/ T1552.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1552/002/ T1552.002], [https://attack.mitre.org/techniques/T1552/ T1552] * '''Last Updated''': 2021-09-06
@@ -8809,6 +9086,10 @@ To successfully implement this search you need to be ingesting information on pr | T1552.002 | Credentials in Registry | Credential Access +|- +| T1552 +| Unsecured Credentials +| Credential Access |} @@ -8843,7 +9124,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-08-24
@@ -8887,6 +9168,10 @@ The following Hunting analytic requires PowerShell operational logs to be import | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -8925,7 +9210,7 @@ This search is to detect a suspicious modification of firewall to allow file and * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-06-23
@@ -8984,6 +9269,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -9020,7 +9309,7 @@ This analytic detects a potential suspicious modification of firewall rule regis * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001], [https://attack.mitre.org/techniques/T1021/ T1021] * '''Last Updated''': 2021-05-26
@@ -9074,6 +9363,10 @@ To successfully implement this search you need to be ingesting information on pr | T1021.001 | Remote Desktop Protocol | Lateral Movement +|- +| T1021 +| Remote Services +| Lateral Movement |} @@ -9108,7 +9401,7 @@ The following analytic identifies suspicious PowerShell command to allow inbound * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001], [https://attack.mitre.org/techniques/T1021/ T1021] * '''Last Updated''': 2021-05-19
@@ -9152,6 +9445,10 @@ To successfully implement this search, you need to be ingesting logs with the po | T1021.001 | Remote Desktop Protocol | Lateral Movement +|- +| T1021 +| Remote Services +| Lateral Movement |} @@ -9186,7 +9483,7 @@ This search is to detect a suspicious modification to the firewall to allow netw * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/007/ T1562.007], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-06-23
@@ -9247,6 +9544,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -9364,7 +9665,7 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001], [https://attack.mitre.org/techniques/T1560/ T1560] * '''Last Updated''': 2021-04-22
@@ -9421,6 +9722,10 @@ To successfully implement this search you need to be ingesting information on pr | T1560.001 | Archive via Utility | Collection +|- +| T1560 +| Archive Collected Data +| Collection |} @@ -9459,7 +9764,7 @@ The following analytic identifies the use of PowerShell downloading a file using * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-03-01
@@ -9517,6 +9822,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -9558,7 +9867,7 @@ The following analytic identifies the use of PowerShell downloading a file using * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-03-01
@@ -9618,6 +9927,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -9995,7 +10308,7 @@ This search looks for execution of commonly used attacker tools on an endpoint. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/005/ T1036.005], [https://attack.mitre.org/techniques/T1595/ T1595], [https://attack.mitre.org/techniques/T1003/ T1003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/005/ T1036.005], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1595/ T1595] * '''Last Updated''': 2021-06-21
@@ -10047,13 +10360,17 @@ To successfully implement this search, you must be ingesting data that records p | Match Legitimate Name or Location | Defense Evasion |- -| T1595 -| Active Scanning -| Reconnaissance +| T1036 +| Masquerading +| Defense Evasion |- | T1003 | OS Credential Dumping | Credential Access +|- +| T1595 +| Active Scanning +| Reconnaissance |} @@ -10088,7 +10405,7 @@ Attempt To Add Certificate To Untrusted Store * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1553/004/ T1553.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1553/004/ T1553.004], [https://attack.mitre.org/techniques/T1553/ T1553] * '''Last Updated''': 2021-09-16
@@ -10141,6 +10458,10 @@ You must be ingesting data that records process activity from your hosts to popu | T1553.004 | Install Root Certificate | Defense Evasion +|- +| T1553 +| Subvert Trust Controls +| Defense Evasion |} @@ -10265,7 +10586,7 @@ This search looks for attempts to stop security-related services on the endpoint * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2020-07-21
@@ -10328,6 +10649,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -10528,7 +10853,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-09-16
@@ -10589,6 +10914,10 @@ To successfully implement this search you need to be ingesting information on pr | T1003.002 | Security Account Manager | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -10623,7 +10952,7 @@ this search is to detect a suspicious registry modification to implement auto ad * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1552/002/ T1552.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1552/002/ T1552.002], [https://attack.mitre.org/techniques/T1552/ T1552] * '''Last Updated''': 2021-09-06
@@ -10668,6 +10997,10 @@ To successfully implement this search you need to be ingesting information on pr | T1552.002 | Credentials in Registry | Credential Access +|- +| T1552 +| Unsecured Credentials +| Credential Access |} @@ -10991,7 +11324,7 @@ The search looks for a batch file (.bat) written to the Windows system directory * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/002/ T1204.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1204/002/ T1204.002] * '''Last Updated''': 2021-09-16
@@ -11043,6 +11376,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1204 +| User Execution +| Execution +|- | T1204.002 | Malicious File | Execution @@ -11248,7 +11585,7 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/003/ T1059.003], [https://attack.mitre.org/techniques/T1543/003/ T1543.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/003/ T1059.003], [https://attack.mitre.org/techniques/T1543/003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543] * '''Last Updated''': 2021-05-20
@@ -11304,6 +11641,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.003 | Windows Command Shell | Execution @@ -11311,6 +11652,10 @@ To successfully implement this search you need to be ingesting information on pr | T1543.003 | Windows Service | Persistence, Privilege Escalation +|- +| T1543 +| Create or Modify System Process +| Persistence, Privilege Escalation |} @@ -11349,7 +11694,7 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/003/ T1218.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/003/ T1218.003] * '''Last Updated''': 2021-05-13
@@ -11398,6 +11743,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.003 | CMSTP | Defense Evasion @@ -11802,6 +12151,93 @@ Unless there are specific use cases, manipulating or exporting certificates usin * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log +''version'': 1 +
+
+ +---- + +===Change default file association=== +This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other payload that will load malicious command to the compromised host. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/001/ T1546.001], [https://attack.mitre.org/techniques/T1546/ T1546] +* '''Last Updated''': 2021-09-27 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `change_default_file_association_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Privilege_Escalation|Windows Privilege Escalation]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +====Required field==== + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_path + +* Registry.registry_key_name + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1546.001 +| Change Default File Association +| Privilege Escalation, Persistence +|- +| T1546 +| Event Triggered Execution +| Privilege Escalation, Persistence +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log + + ''version'': 1
@@ -12056,7 +12492,7 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/004/ T1070.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/004/ T1070.004], [https://attack.mitre.org/techniques/T1070/ T1070] * '''Last Updated''': 2021-06-10
@@ -12115,6 +12551,10 @@ To successfully implement this search you need to be ingesting information on pr | T1070.004 | File Deletion | Defense Evasion +|- +| T1070 +| Indicator Removal on Host +| Defense Evasion |} @@ -12330,7 +12770,7 @@ This search is to detect a suspicious parent process execution of commandline to * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/007/ T1059.007] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/007/ T1059.007] * '''Last Updated''': 2021-09-14
@@ -12378,6 +12818,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.007 | JavaScript | Execution @@ -12777,7 +13221,7 @@ The following detection identifies control.exe loading either a .cpl or .inf fro * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/002/ T1218.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/002/ T1218.002] * '''Last Updated''': 2021-09-08
@@ -12831,6 +13275,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.002 | Control Panel | Defense Evasion @@ -12960,7 +13408,7 @@ Detect remote thread creation into LSASS consistent with credential dumping. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2019-12-06
@@ -13011,6 +13459,10 @@ This search needs Sysmon Logs with a Sysmon configuration, which includes EventC | T1003.001 | LSASS Memory | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -13045,7 +13497,7 @@ This detection is to identify a creation of "user mode service" where th * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/002/ T1569.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1569/002/ T1569.002] * '''Last Updated''': 2021-03-12
@@ -13088,6 +13540,10 @@ To successfully implement this search, you need to be ingesting logs with the Se ! Technique ! Tactic |- +| T1569 +| System Services +| Execution +|- | T1569.002 | Service Execution | Execution @@ -13127,7 +13583,7 @@ This search looks for the creation of local administrator accounts using net.exe * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/001/ T1136.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/001/ T1136.001], [https://attack.mitre.org/techniques/T1136/ T1136] * '''Last Updated''': 2021-09-08
@@ -13186,6 +13642,10 @@ You must be ingesting data that records process activity from your hosts to popu | T1136.001 | Local Account | Persistence +|- +| T1136 +| Create Account +| Persistence |} @@ -13220,7 +13680,7 @@ This search looks for the creation or deletion of hidden shares using net.exe. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/005/ T1070.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1070/005/ T1070.005] * '''Last Updated''': 2020-09-16
@@ -13277,6 +13737,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1070 +| Indicator Removal on Host +| Defense Evasion +|- | T1070.005 | Network Share Connection Removal | Defense Evasion @@ -13314,7 +13778,7 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2019-12-10
@@ -13373,6 +13837,10 @@ You must be ingesting endpoint data that tracks process activity, including pare | T1003.003 | NTDS | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -13407,7 +13875,7 @@ This search detects the use of wmic and Powershell to create a shadow copy. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-09-16
@@ -13466,6 +13934,10 @@ To successfully implement this search you need to be ingesting information on pr | T1003.003 | NTDS | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -13500,7 +13972,7 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-02-03
@@ -13547,6 +14019,10 @@ This search requires Sysmon Logs and a Sysmon configuration, which includes Even | T1003.001 | LSASS Memory | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -13585,7 +14061,7 @@ This search detects credential dumping using copy command from a shadow copy. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-09-16
@@ -13644,6 +14120,10 @@ To successfully implement this search you need to be ingesting information on pr | T1003.003 | NTDS | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -13678,7 +14158,7 @@ This search detects the creation of a symlink to a shadow copy. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-09-16
@@ -13737,6 +14217,10 @@ To successfully implement this search you need to be ingesting information on pr | T1003.003 | NTDS | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -14593,23 +15077,23 @@ The following analytic identifies DLLHost.exe with no command line arguments wit * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint * '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055] -* '''Last Updated''': 2021-04-19 +* '''Last Updated''': 2021-10-13
====Search==== -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(dllhost\.exe.{0,4}$)" -| join process_id [ -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] -| table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port +| table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter` ====Associated Analytic Story==== @@ -14672,7 +15156,7 @@ Although unlikely, some legitimate third party applications may use a moved copy * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log -''version'': 1 +''version'': 2
@@ -15324,7 +15808,7 @@ This search looks for specific authentication events from the Windows Security E * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1550/002/ T1550.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1550/ T1550], [https://attack.mitre.org/techniques/T1550/002/ T1550.002] * '''Last Updated''': 2020-10-15
@@ -15370,6 +15854,10 @@ To successfully implement this search, you must ingest your Windows Security Eve ! Technique ! Tactic |- +| T1550 +| Use Alternate Authentication Material +| Defense Evasion, Lateral Movement +|- | T1550.002 | Pass the Hash | Defense Evasion, Lateral Movement @@ -15403,7 +15891,7 @@ The following analytic identifies the common command-line argument used by Azure * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/ T1069] * '''Last Updated''': 2021-06-01
@@ -15463,20 +15951,28 @@ To successfully implement this search you need to be ingesting information on pr | Domain Account | Discovery |- -| T1087.001 -| Local Account +| T1069.001 +| Local Groups | Discovery |- | T1482 | Domain Trust Discovery | Discovery |- +| T1087.001 +| Local Account +| Discovery +|- +| T1087 +| Account Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery |- -| T1069.001 -| Local Groups +| T1069 +| Permission Groups Discovery | Discovery |} @@ -15518,7 +16014,7 @@ The following analytic is similar to SharpHound file modifications, but this ins * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/ T1069] * '''Last Updated''': 2021-06-01
@@ -15566,20 +16062,28 @@ To successfully implement this search you need to be ingesting information on fi | Domain Account | Discovery |- -| T1087.001 -| Local Account +| T1069.001 +| Local Groups | Discovery |- | T1482 | Domain Trust Discovery | Discovery |- +| T1087.001 +| Local Account +| Discovery +|- +| T1087 +| Account Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery |- -| T1069.001 -| Local Groups +| T1069 +| Permission Groups Discovery | Discovery |} @@ -15899,7 +16403,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-07-21
@@ -15945,6 +16449,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri | T1003.002 | Security Account Manager | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -15983,7 +16491,7 @@ This search looks for reading lsass memory consistent with credential dumping. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2019-12-03
@@ -16038,6 +16546,10 @@ This search needs Sysmon Logs and a sysmon configuration, which includes EventCo | T1003.001 | LSASS Memory | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -16068,7 +16580,7 @@ This search detects the memory of lsass.exe being dumped for offline credential * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-09-15
@@ -16113,6 +16625,10 @@ You must be ingesting endpoint data that tracks process activity, including Wind | T1003.003 | NTDS | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -16149,7 +16665,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-06-09
@@ -16192,6 +16708,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -16237,7 +16757,7 @@ This search identifies endpoints that have caused a relatively high number of ac * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/002/ T1078.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1078/002/ T1078.002] * '''Last Updated''': 2020-11-09
@@ -16285,6 +16805,10 @@ If Splunk>Phantom is also configured in your environment, a Playbook called & ! Technique ! Tactic |- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- | T1078.002 | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access @@ -16318,7 +16842,7 @@ This search detects user accounts that have been locked out a relatively high nu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/003/ T1078.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1078/003/ T1078.003] * '''Last Updated''': 2020-07-21
@@ -16360,6 +16884,10 @@ ou must ingest your Windows security event logs in the `Change` datamodel under ! Technique ! Tactic |- +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- | T1078.003 | Local Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access @@ -16393,7 +16921,7 @@ The following query identifies suspicious .aspx created in 3 paths identified by * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1505/003/ T1505.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1505/ T1505], [https://attack.mitre.org/techniques/T1505/003/ T1505.003] * '''Last Updated''': 2021-10-05
@@ -16443,6 +16971,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1505 +| Server Software Component +| Persistence +|- | T1505.003 | Web Shell | Persistence @@ -16486,7 +17018,7 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/001/ T1218.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/001/ T1218.001] * '''Last Updated''': 2021-09-16
@@ -16542,6 +17074,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.001 | Compiled HTML File | Defense Evasion @@ -16583,7 +17119,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/001/ T1218.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/001/ T1218.001] * '''Last Updated''': 2021-02-11
@@ -16639,6 +17175,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.001 | Compiled HTML File | Defense Evasion @@ -16684,7 +17224,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/001/ T1218.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/001/ T1218.001] * '''Last Updated''': 2021-09-16
@@ -16740,6 +17280,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.001 | Compiled HTML File | Defense Evasion @@ -16787,7 +17331,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/001/ T1218.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/001/ T1218.001] * '''Last Updated''': 2021-09-16
@@ -16843,6 +17387,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.001 | Compiled HTML File | Defense Evasion @@ -16890,7 +17438,7 @@ This search detects a potential kerberoasting attack via service principal name * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1558/003/ T1558.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1558/003/ T1558.003], [https://attack.mitre.org/techniques/T1558/ T1558] * '''Last Updated''': 2020-10-21
@@ -16940,6 +17488,10 @@ The test data is converted from Windows Security Event logs generated from Attac | T1558.003 | Kerberoasting | Credential Access +|- +| T1558 +| Steal or Forge Kerberos Tickets +| Credential Access |} @@ -16972,7 +17524,7 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/005/ T1218.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/005/ T1218.005] * '''Last Updated''': 2021-09-16
@@ -17028,6 +17580,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.005 | Mshta | Defense Evasion @@ -17069,7 +17625,7 @@ This search looks for reading loaded Images unique to credential dumping with Mi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2019-12-03
@@ -17123,6 +17679,10 @@ This search needs Sysmon Logs and a sysmon configuration, which includes EventCo | T1003.001 | LSASS Memory | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -17245,7 +17805,7 @@ This search looks for newly created accounts that have been elevated to local ad * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/001/ T1136.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/001/ T1136.001], [https://attack.mitre.org/techniques/T1136/ T1136] * '''Last Updated''': 2020-07-08
@@ -17295,6 +17855,10 @@ You must be ingesting Windows event logs using the Splunk Windows TA and collect | T1136.001 | Local Account | Persistence +|- +| T1136 +| Create Account +| Persistence |} @@ -17331,7 +17895,7 @@ This search looks for execution of process `outlook.exe` where the process is wr * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2020-07-21
@@ -17388,6 +17952,10 @@ You must be ingesting data that records filesystem and process activity from you ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -17421,7 +17989,7 @@ This search looks for specific authentication events from the Windows Security E * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1550/002/ T1550.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1550/ T1550], [https://attack.mitre.org/techniques/T1550/002/ T1550.002] * '''Last Updated''': 2020-10-21
@@ -17471,6 +18039,10 @@ The test data is converted from Windows Security Event logs generated from Attac ! Technique ! Tactic |- +| T1550 +| Use Alternate Authentication Material +| Defense Evasion, Lateral Movement +|- | T1550.002 | Pass the Hash | Defense Evasion, Lateral Movement @@ -17506,7 +18078,7 @@ The detection Detect Path Interception By Creation Of program exe is detecting t * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1574/009/ T1574.009] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1574/009/ T1574.009], [https://attack.mitre.org/techniques/T1574/ T1574] * '''Last Updated''': 2020-07-03
@@ -17572,6 +18144,10 @@ You must be ingesting data that records process activity from your hosts to popu | T1574.009 | Path Interception by Unquoted Path | Persistence, Privilege Escalation, Defense Evasion +|- +| T1574 +| Hijack Execution Flow +| Persistence, Privilege Escalation, Defense Evasion |} @@ -17606,7 +18182,7 @@ This search looks for executions of cmd.exe spawned by a process that is often a * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/003/ T1059.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/003/ T1059.003] * '''Last Updated''': 2020-11-10
@@ -17669,6 +18245,10 @@ You must be ingesting data that records process activity from your hosts and pop ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.003 | Windows Command Shell | Execution @@ -17787,7 +18367,7 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/002/ T1021.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1021/002/ T1021.002] * '''Last Updated''': 2021-09-16
@@ -17851,6 +18431,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1021 +| Remote Services +| Lateral Movement +|- | T1021.002 | SMB/Windows Admin Shares | Lateral Movement @@ -18050,7 +18634,7 @@ The following analytic identifies regasm.exe spawning a process. This particular * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/009/ T1218.009] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/009/ T1218.009] * '''Last Updated''': 2021-02-12
@@ -18098,6 +18682,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.009 | Regsvcs/Regasm | Defense Evasion @@ -18141,7 +18729,7 @@ The following analytic identifies regasm.exe with a network connection to a publ * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/009/ T1218.009] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/009/ T1218.009] * '''Last Updated''': 2021-02-16
@@ -18191,6 +18779,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.009 | Regsvcs/Regasm | Defense Evasion @@ -18232,7 +18824,7 @@ The following analytic identifies regasm.exe with no command line arguments. Thi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/009/ T1218.009] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/009/ T1218.009] * '''Last Updated''': 2021-09-20
@@ -18289,6 +18881,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.009 | Regsvcs/Regasm | Defense Evasion @@ -18330,7 +18926,7 @@ The following analytic identifies regsvcs.exe spawning a process. This particula * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/009/ T1218.009] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/009/ T1218.009] * '''Last Updated''': 2021-02-12
@@ -18380,6 +18976,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.009 | Regsvcs/Regasm | Defense Evasion @@ -18421,7 +19021,7 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/009/ T1218.009] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/009/ T1218.009] * '''Last Updated''': 2021-02-16
@@ -18469,6 +19069,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.009 | Regsvcs/Regasm | Defense Evasion @@ -18510,7 +19114,7 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/009/ T1218.009] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/009/ T1218.009] * '''Last Updated''': 2021-09-20
@@ -18567,6 +19171,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.009 | Regsvcs/Regasm | Defense Evasion @@ -18609,7 +19217,7 @@ Upon investigating, look for network connections to remote destinations (interna * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/010/ T1218.010] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/010/ T1218.010] * '''Last Updated''': 2021-01-28
@@ -18667,6 +19275,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.010 | Regsvr32 | Defense Evasion @@ -18710,7 +19322,7 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001], [https://attack.mitre.org/techniques/T1560/ T1560] * '''Last Updated''': 2021-09-16
@@ -18769,6 +19381,10 @@ To successfully implement this search you need to be ingesting information on pr | T1560.001 | Archive via Utility | Collection +|- +| T1560 +| Archive Collected Data +| Collection |} @@ -18803,7 +19419,7 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/002/ T1569.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1569/002/ T1569.002] * '''Last Updated''': 2021-09-16
@@ -18867,6 +19483,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1569 +| System Services +| Execution +|- | T1569.002 | Service Execution | Execution @@ -19009,7 +19629,7 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001], [https://attack.mitre.org/techniques/T1560/ T1560] * '''Last Updated''': 2021-09-16
@@ -19068,6 +19688,10 @@ To successfully implement this search you need to be ingesting information on pr | T1560.001 | Archive via Utility | Collection +|- +| T1560 +| Archive Collected Data +| Collection |} @@ -19104,7 +19728,7 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-02-04
@@ -19160,6 +19784,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -19205,7 +19833,7 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-02-04
@@ -19261,6 +19889,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -19306,7 +19938,7 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-02-04
@@ -19362,6 +19994,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -19407,7 +20043,7 @@ The following analytic identifies "rundll32.exe" execution with inline p * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/005/ T1218.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/005/ T1218.005] * '''Last Updated''': 2021-01-20
@@ -19465,6 +20101,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.005 | Mshta | Defense Evasion @@ -19506,7 +20146,7 @@ The following analytic identifies common command-line arguments used by SharpHou * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/ T1069] * '''Last Updated''': 2021-06-01
@@ -19560,20 +20200,28 @@ To successfully implement this search you need to be ingesting information on pr | Domain Account | Discovery |- -| T1087.001 -| Local Account +| T1069.001 +| Local Groups | Discovery |- | T1482 | Domain Trust Discovery | Discovery |- +| T1087.001 +| Local Account +| Discovery +|- +| T1087 +| Account Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery |- -| T1069.001 -| Local Groups +| T1069 +| Permission Groups Discovery | Discovery |} @@ -19617,7 +20265,7 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/ T1069] * '''Last Updated''': 2021-05-27
@@ -19667,20 +20315,28 @@ To successfully implement this search you need to be ingesting information on fi | Domain Account | Discovery |- -| T1087.001 -| Local Account +| T1069.001 +| Local Groups | Discovery |- | T1482 | Domain Trust Discovery | Discovery |- +| T1087.001 +| Local Account +| Discovery +|- +| T1087 +| Account Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery |- -| T1069.001 -| Local Groups +| T1069 +| Permission Groups Discovery | Discovery |} @@ -19724,7 +20380,7 @@ The following analytic identifies SharpHound binary usage by using the original * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1069/001/ T1069.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1087/001/ T1087.001], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1069/002/ T1069.002], [https://attack.mitre.org/techniques/T1069/ T1069] * '''Last Updated''': 2021-05-27
@@ -19786,20 +20442,28 @@ To successfully implement this search you need to be ingesting information on pr | Domain Account | Discovery |- -| T1087.001 -| Local Account +| T1069.001 +| Local Groups | Discovery |- | T1482 | Domain Trust Discovery | Discovery |- +| T1087.001 +| Local Account +| Discovery +|- +| T1087 +| Account Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery |- -| T1069.001 -| Local Groups +| T1069 +| Permission Groups Discovery | Discovery |} @@ -19843,7 +20507,7 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/003/ T1059.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/003/ T1059.003] * '''Last Updated''': 2020-07-21
@@ -19891,6 +20555,10 @@ To successfully implement this search, you must be ingesting data that records p ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.003 | Windows Command Shell | Execution @@ -19929,7 +20597,7 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/003/ T1546.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/003/ T1546.003], [https://attack.mitre.org/techniques/T1546/ T1546] * '''Last Updated''': 2021-06-16
@@ -19971,6 +20639,10 @@ To successfully implement this search, you need to be ingesting logs with that p | T1546.003 | Windows Management Instrumentation Event Subscription | Privilege Escalation, Persistence +|- +| T1546 +| Event Triggered Execution +| Privilege Escalation, Persistence |} @@ -20011,7 +20683,7 @@ The following analytic identifies "mshta.exe" execution with inline prot * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/005/ T1218.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/005/ T1218.005] * '''Last Updated''': 2021-09-16
@@ -20067,6 +20739,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.005 | Mshta | Defense Evasion @@ -20108,7 +20784,7 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/005/ T1218.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/005/ T1218.005] * '''Last Updated''': 2021-09-16
@@ -20164,6 +20840,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.005 | Mshta | Defense Evasion @@ -20375,7 +21055,7 @@ this search is to identify modification in registry to disable AMSI windows feat * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-06-22
@@ -20422,6 +21102,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -20458,7 +21142,7 @@ this search is to identify modification in registry to disable ETW windows featu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-06-22
@@ -20505,6 +21189,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -20539,7 +21227,7 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/001/ T1070.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1070/001/ T1070.001] * '''Last Updated''': 2021-06-10
@@ -20589,6 +21277,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1070 +| Indicator Removal on Host +| Defense Evasion +|- | T1070.001 | Clear Windows Event Logs | Defense Evasion @@ -20711,7 +21403,7 @@ This search identifies modification of registry to disable the regedit or regist * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-31
@@ -20758,6 +21450,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -20785,6 +21481,88 @@ admin may disable this application for non technical user. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log +''version'': 1 +
+
+ +---- + +===Disable security logs using minint registry=== +This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and will not log any event to the Security Log + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1112/ T1112] +* '''Last Updated''': 2021-10-05 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*" by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `disable_security_logs_using_minint_registry_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +====Required field==== + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_value_name + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.registry_value_data + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1112 +| Modify Registry +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Unknown. + +====Reference==== + + +* https://twitter.com/0gtweet/status/1182516740955226112 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log + + ''version'': 1
@@ -20796,7 +21574,7 @@ The following analytic is to identify a modification in the Windows registry to * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1564/001/ T1564.001], [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1564/001/ T1564.001], [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1564/ T1564], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-31
@@ -20847,6 +21625,14 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1564 +| Hide Artifacts +| Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -20874,6 +21660,95 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log +''version'': 1 +
+
+ +---- + +===Disable uac remote restriction=== +This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. This is a good indicator that some tries to bypassed UAC to suspicious process or gain privilege escalation. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002], [https://attack.mitre.org/techniques/T1548/ T1548] +* '''Last Updated''': 2021-09-29 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `disable_uac_remote_restriction_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Windows_Registry_Activities|Suspicious Windows Registry Activities]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +====Required field==== + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_path + +* Registry.registry_key_name + +* Registry.registry_value_name + +* Registry.registry_value_data + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1548.002 +| Bypass User Account Control +| Privilege Escalation, Defense Evasion +|- +| T1548 +| Abuse Elevation Control Mechanism +| Privilege Escalation, Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may set this policy for non-critical machine. + +====Reference==== + + +* https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log + + ''version'': 1
@@ -20885,7 +21760,7 @@ This analytic detects a suspicious registry modification to disable Windows hotk * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-05-05
@@ -20930,6 +21805,10 @@ To successfully implement this search, you must be ingesting data that records r | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -20964,7 +21843,7 @@ This search is to identifies a modification in registry to disable the windows d * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-31
@@ -21015,6 +21894,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -21053,7 +21936,7 @@ The following search identifies a modification of registry to disable the smarts * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-31
@@ -21100,6 +21983,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -21138,7 +22025,7 @@ this search is to identify modification in registry to disable cmd prompt applic * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-31
@@ -21185,6 +22072,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -21223,7 +22114,7 @@ this search is to identify registry modification to disable control panel window * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-31
@@ -21270,6 +22161,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -21308,7 +22203,7 @@ This search is to identifies suspicious firewall disabling using netsh applicati * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-31
@@ -21367,6 +22262,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -21405,7 +22304,7 @@ This search is to identify registry modification to disable folder options featu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-31
@@ -21452,6 +22351,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -21583,7 +22486,7 @@ This search is to identify modification of registry to disable run application i * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-31
@@ -21630,6 +22533,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -21670,7 +22577,7 @@ The search looks for modifications to registry keys that control the enforcement * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2020-11-18
@@ -21721,6 +22628,10 @@ To successfully implement this search, you must be ingesting data that records r | T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion +|- +| T1548 +| Abuse Elevation Control Mechanism +| Privilege Escalation, Defense Evasion |} @@ -21751,7 +22662,7 @@ The following search identifies the modification of registry related in disablin * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-31
@@ -21798,6 +22709,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -21836,7 +22751,7 @@ This search is to identifies modification of registry to disable the task manage * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-31
@@ -21883,6 +22798,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -21923,7 +22842,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-08-24
@@ -21976,6 +22895,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -22012,7 +22935,7 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-08-24
@@ -22065,6 +22988,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -22101,7 +23028,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-08-24
@@ -22154,6 +23081,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -22370,7 +23301,7 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-09-01
@@ -22424,6 +23355,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -22461,7 +23396,7 @@ This analytic looks for the execution of `net.exe` with command-line arguments u * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-25
@@ -22515,6 +23450,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -22552,7 +23491,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-25
@@ -22606,6 +23545,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -22643,7 +23586,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-25
@@ -22683,6 +23626,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -22804,7 +23751,7 @@ This search is to detect dropping a suspicious file named as "license.dat * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/002/ T1204.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1204/002/ T1204.002] * '''Last Updated''': 2021-07-30
@@ -22837,6 +23784,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1204 +| User Execution +| Execution +|- | T1204.002 | Malicious File | Execution @@ -22874,7 +23825,7 @@ Detect the usage of comsvcs.dll for dumping the lsass process. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-02-21
@@ -22937,6 +23888,10 @@ To successfully implement this search you need to be ingesting information on pr | T1003.001 | LSASS Memory | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -22974,7 +23929,7 @@ During triage, confirm this is procdump.exe executing. If it is the first time a * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/001/ T1003.001], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-09-16
@@ -23027,6 +23982,10 @@ To successfully implement this search you need to be ingesting information on pr | T1003.001 | LSASS Memory | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -23060,12 +24019,104 @@ None identified. ---- +===Etw registry disabled=== +This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/006/ T1562.006], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1562/ T1562] +* '''Last Updated''': 2021-10-07 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*") Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `etw_registry_disabled_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Privilege_Escalation|Windows Privilege Escalation]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +====Required field==== + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_path + +* Registry.registry_key_name + +* Registry.registry_value_name + +* Registry.registry_value_data + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.006 +| Indicator Blocking +| Defense Evasion +|- +| T1127 +| Trusted Developer Utilities Proxy Execution +| Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log + + +''version'': 1 +
+
+ +---- + ===Elevated group discovery with net=== This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-25
@@ -23119,6 +24170,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -23160,7 +24215,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-25
@@ -23214,6 +24269,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -23255,7 +24314,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-25
@@ -23295,6 +24354,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -23406,6 +24469,92 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log +''version'': 1 +
+
+ +---- + +===Enable wdigest uselogoncredential registry=== +This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised or target host. This TTP is really a good indicator that someone wants to dump the crendential of the host so it must be a good pivot for credential dumping techniques. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1003/ T1003] +* '''Last Updated''': 2021-10-05 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name Registry.registry_path Registry.registry_value_data +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `enable_wdigest_uselogoncredential_registry_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +====Required field==== + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_value_name + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.registry_value_data + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1112 +| Modify Registry +| Defense Evasion +|- +| T1003 +| OS Credential Dumping +| Credential Access +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log + + ''version'': 1
@@ -23507,7 +24656,7 @@ The following analytic identifies the process - `esentutl.exe` - being used to c * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-08-18
@@ -23566,6 +24715,10 @@ To successfully implement this search you need to be ingesting information on pr | T1003.002 | Security Account Manager | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -23602,7 +24755,7 @@ The following search identifies Eventvwr bypass by identifying the registry modi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2021-03-01
@@ -23651,6 +24804,10 @@ To successfully implement this search you need to be ingesting information on pr | T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion +|- +| T1548 +| Abuse Elevation Control Mechanism +| Privilege Escalation, Defense Evasion |} @@ -23693,7 +24850,7 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-04-12
@@ -23750,6 +24907,10 @@ To successfully implement this search you need to be ingesting information on pr | T1003.002 | Security Account Manager | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -23786,7 +24947,7 @@ The following detection identifies Microsoft Excel spawning Windows Script Host * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-04-12
@@ -23835,6 +24996,10 @@ To successfully implement this search you need to be ingesting information on pr | T1003.002 | Security Account Manager | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -24231,7 +25396,7 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/002/ T1569.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1569/002/ T1569.002] * '''Last Updated''': 2021-06-24
@@ -24275,6 +25440,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1569 +| System Services +| Execution +|- | T1569.002 | Service Execution | Execution @@ -24312,7 +25481,7 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-05-04
@@ -24362,6 +25531,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -24565,7 +25738,7 @@ This detection targets behaviors observed when threat actors have used sc.exe to * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-06-25
@@ -24617,6 +25790,10 @@ You must be ingesting data that records process activity from your hosts to popu | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -24827,7 +26004,7 @@ Module - New-managementroleassignment can assign a management role to a manageme * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-08-27
@@ -24872,6 +26049,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -24998,7 +26179,7 @@ This analytic will identify suspicious process of cscript.exe where it tries to * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/005/ T1059.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/005/ T1059.005] * '''Last Updated''': 2021-06-22
@@ -25046,6 +26227,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.005 | Visual Basic | Execution @@ -25083,7 +26268,7 @@ This search looks for processes launched from files that have double extensions * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/003/ T1036.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1036/003/ T1036.003] * '''Last Updated''': 2020-11-18
@@ -25127,6 +26312,10 @@ To successfully implement this search, you must be ingesting data that records p ! Technique ! Tactic |- +| T1036 +| Masquerading +| Defense Evasion +|- | T1036.003 | Rename System Utilities | Defense Evasion @@ -25160,7 +26349,7 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-09-09
@@ -25221,6 +26410,10 @@ To successfully implement this search you need to be ingesting information on pr | T1003.002 | Security Account Manager | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -25406,7 +26599,7 @@ This search looks for the first and last time a Windows service is seen running * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/002/ T1569.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1569/002/ T1569.002] * '''Last Updated''': 2020-07-21
@@ -25451,6 +26644,10 @@ While this search does not require you to adhere to Splunk CIM, you must be inge ! Technique ! Tactic |- +| T1569 +| System Services +| Execution +|- | T1569.002 | Service Execution | Execution @@ -25577,7 +26774,7 @@ Upon triage, fodhelper.exe will have a child process and read access will occur * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1548/002/ T1548.002], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2021-03-01
@@ -25636,6 +26833,10 @@ To successfully implement this search you need to be ingesting information on pr | T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion +|- +| T1548 +| Abuse Elevation Control Mechanism +| Privilege Escalation, Defense Evasion |} @@ -25769,16 +26970,16 @@ The following analytic identifies gpupdate.exe with no command line arguments an ====Search==== -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(gpupdate\.exe.{0,4}$)" -| join process_id [ -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] -| table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port +| table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter` ====Associated Analytic Story==== @@ -26025,7 +27226,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-08-24
@@ -26078,6 +27279,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -26116,7 +27321,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-08-24
@@ -26160,6 +27365,10 @@ The following Hunting analytic requires PowerShell operational logs to be import | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -26544,7 +27753,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-08-24
@@ -26597,6 +27806,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -26631,7 +27844,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-08-24
@@ -26675,6 +27888,10 @@ The following Hunting analytic requires PowerShell operational logs to be import | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -26709,7 +27926,7 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] * '''Last Updated''': 2021-09-14
@@ -26765,6 +27982,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.001 | Local Groups | Discovery @@ -26806,7 +28027,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] * '''Last Updated''': 2021-09-14
@@ -26847,6 +28068,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.001 | Local Groups | Discovery @@ -27426,7 +28651,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-25
@@ -27480,6 +28705,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -27519,7 +28748,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-25
@@ -27559,6 +28788,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -28116,7 +29349,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-25
@@ -28170,6 +29403,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -28209,7 +29446,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-26
@@ -28249,6 +29486,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -28288,7 +29529,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/001/ T1087.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1087/001/ T1087.001] * '''Last Updated''': 2021-08-23
@@ -28322,6 +29563,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1087 +| Account Discovery +| Discovery +|- | T1087.001 | Local Account | Discovery @@ -28359,7 +29604,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/001/ T1087.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1087/001/ T1087.001] * '''Last Updated''': 2021-08-23
@@ -28391,6 +29636,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1087 +| Account Discovery +| Discovery +|- | T1087.001 | Local Account | Discovery @@ -28600,7 +29849,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-08-24
@@ -28653,6 +29902,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -28687,7 +29940,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-08-24
@@ -28731,6 +29984,10 @@ he following Hunting analytic requires PowerShell operational logs to be importe | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -28937,7 +30194,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-25
@@ -28991,6 +30248,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -29030,7 +30291,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/002/ T1069.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/002/ T1069.002] * '''Last Updated''': 2021-08-25
@@ -29070,6 +30331,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.002 | Domain Groups | Discovery @@ -29109,7 +30374,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/001/ T1087.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1087/001/ T1087.001] * '''Last Updated''': 2021-08-23
@@ -29143,6 +30408,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1087 +| Account Discovery +| Discovery +|- | T1087.001 | Local Account | Discovery @@ -29180,7 +30449,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/001/ T1087.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1087/001/ T1087.001] * '''Last Updated''': 2021-08-23
@@ -29212,6 +30481,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1087 +| Account Discovery +| Discovery +|- | T1087.001 | Local Account | Discovery @@ -29332,7 +30605,7 @@ This analytic identifies a suspicious registry modification to hide a user accou * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-05-05
@@ -29377,6 +30650,10 @@ To successfully implement this search, you must be ingesting data that records r | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -29411,7 +30688,7 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1222/001/ T1222.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1222/001/ T1222.001] * '''Last Updated''': 2020-07-21
@@ -29457,6 +30734,10 @@ You must be ingesting data that records process activity from your hosts to popu ! Technique ! Tactic |- +| T1222 +| File and Directory Permissions Modification +| Defense Evasion +|- | T1222.001 | Windows File and Directory Permissions Modification | Defense Evasion @@ -29825,7 +31106,7 @@ This search is to detect a suspicious file creation namely passff.tar and cookie * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1560/001/ T1560.001], [https://attack.mitre.org/techniques/T1560/ T1560] * '''Last Updated''': 2021-07-30
@@ -29871,6 +31152,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1560.001 | Archive via Utility | Collection +|- +| T1560 +| Archive Collected Data +| Collection |} @@ -30761,7 +32046,7 @@ This search is to detect a execution of jscript using cscript process. Commonly * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/007/ T1059.007] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/007/ T1059.007] * '''Last Updated''': 2021-09-13
@@ -30809,6 +32094,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.007 | JavaScript | Execution @@ -30848,7 +32137,7 @@ This search detects a potential kerberoasting attack via service principal name * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1558/003/ T1558.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1558/003/ T1558.003], [https://attack.mitre.org/techniques/T1558/ T1558] * '''Last Updated''': 2020-10-16
@@ -30896,6 +32185,10 @@ You must be ingesting endpoint data that tracks process activity, and include th | T1558.003 | Kerberoasting | Credential Access +|- +| T1558 +| Steal or Forge Kerberos Tickets +| Credential Access |} @@ -31014,7 +32307,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/001/ T1087.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1087/001/ T1087.001] * '''Last Updated''': 2021-09-16
@@ -31048,6 +32341,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1087 +| Account Discovery +| Discovery +|- | T1087.001 | Local Account | Discovery @@ -31085,7 +32382,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/001/ T1087.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1087/001/ T1087.001] * '''Last Updated''': 2021-09-16
@@ -31119,6 +32416,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1087 +| Account Discovery +| Discovery +|- | T1087.001 | Local Account | Discovery @@ -31151,12 +32452,99 @@ Administrators or power users may use this command for troubleshooting. ---- +===Logon script event trigger execution=== +This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript registry entry to its malicious payload to be executed upon boot up of the machine. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1037/ T1037], [https://attack.mitre.org/techniques/T1037/001/ T1037.001] +* '''Last Updated''': 2021-09-27 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `logon_script_event_trigger_execution_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Privilege_Escalation|Windows Privilege Escalation]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +====Required field==== + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_path + +* Registry.registry_key_name + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1037 +| Boot or Logon Initialization Scripts +| Persistence, Privilege Escalation +|- +| T1037.001 +| Logon Script (Windows) +| Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://attack.mitre.org/techniques/T1037/001 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log + + +''version'': 1 +
+
+ +---- + ===Ms scripting process loading ldap module=== This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading ldap module to process ldap query. This behavior was seen in FIN7 implant where it uses javascript to execute ldap query to parse host information that will send to its C2 server. this anomaly detections is a good initial step to hunt further a suspicious ldap query or ldap related events to the host that may give you good information regarding ldap or AD information processing or might be a attacker. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/007/ T1059.007] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/007/ T1059.007] * '''Last Updated''': 2021-09-13
@@ -31203,6 +32591,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.007 | JavaScript | Execution @@ -31242,7 +32634,7 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/007/ T1059.007] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/007/ T1059.007] * '''Last Updated''': 2021-09-13
@@ -31289,6 +32681,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.007 | JavaScript | Execution @@ -31317,6 +32713,93 @@ automation scripting language may used by network operator to do ldap query. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log +''version'': 1 +
+
+ +---- + +===Msbuild suspicious spawned by script process=== +This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using malicious script in the compromised host. During triage, review parallel processes and identify any file modifications. MSBuild may load a script from the same path without having command-line arguments. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1127/001/ T1127.001], [https://attack.mitre.org/techniques/T1127/ T1127] +* '''Last Updated''': 2021-10-04 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("wscript.exe", "cscript.exe") AND `process_msbuild` by Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `msbuild_suspicious_spawned_by_script_process_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Trusted_Developer_Utilities_Proxy_Execution_MSBuild|Trusted Developer Utilities Proxy Execution MSBuild]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.parent_process + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.original_file_name + +* Processes.user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1127.001 +| MSBuild +| Defense Evasion +|- +| T1127 +| Trusted Developer Utilities Proxy Execution +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +False positives should be limited as developers do not spawn MSBuild via a WSH. + +====Reference==== + + +* https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log + + ''version'': 1
@@ -31328,7 +32811,7 @@ The following detection identifies the module load of mshtml.dll into an Office * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-09-09
@@ -31374,6 +32857,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -31481,7 +32968,7 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/001/ T1114.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114/001/ T1114.001] * '''Last Updated''': 2021-05-19
@@ -31522,6 +33009,10 @@ To successfully implement this search, you need to be ingesting logs with the po ! Technique ! Tactic |- +| T1114 +| Email Collection +| Collection +|- | T1114.001 | Local Email Collection | Collection @@ -31548,6 +33039,104 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log +''version'': 1 +
+
+ +---- + +===Malicious inprocserver32 modification=== +The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID). Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/010/ T1218.010], [https://attack.mitre.org/techniques/T1112/ T1112] +* '''Last Updated''': 2021-10-05 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user +| `drop_dm_object_name(Processes)` +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest Registry.process_guid Registry.user +| `drop_dm_object_name(Registry)` +| fields _time dest registry_path registry_key_name registry_value_name process_name process_path process process_guid user] +| stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name registry_path registry_key_name registry_value_name user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `malicious_inprocserver32_modification_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Regsvr32_Activity|Suspicious Regsvr32 Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Remcos|Remcos]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +====Required field==== + +* _time + +* dest + +* process_name + +* registry_path + +* registry_key_name + +* registry_value_name + +* user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1218.010 +| Regsvr32 +| Defense Evasion +|- +| T1112 +| Modify Registry +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line. + +====Reference==== + + +* https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ + +* https://tria.ge/210929-ap75vsddan + +* https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log + + ''version'': 1
@@ -31559,7 +33148,7 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001], [https://attack.mitre.org/techniques/T1059/ T1059] * '''Last Updated''': 2021-10-05
@@ -31615,6 +33204,10 @@ You must be ingesting data that records process activity from your hosts to popu | T1059.001 | PowerShell | Execution +|- +| T1059 +| Command and Scripting Interpreter +| Execution |} @@ -31758,7 +33351,7 @@ This search looks for PowerShell processes started with parameters used to bypas * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2020-07-21
@@ -31816,6 +33409,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -31851,7 +33448,7 @@ This search looks for PowerShell processes launched with arguments that have cha * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-01-19
@@ -31909,6 +33506,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -31944,7 +33545,7 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/002/ T1569.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1569/002/ T1569.002] * '''Last Updated''': 2021-04-07
@@ -32000,6 +33601,10 @@ To successfully implement this search, you need to be ingesting Windows System l ! Technique ! Tactic |- +| T1569 +| System Services +| Execution +|- | T1569.002 | Service Execution | Execution @@ -32299,7 +33904,7 @@ This search looks for registry activity associated with modifications to the reg * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/010/ T1547.010] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/010/ T1547.010], [https://attack.mitre.org/techniques/T1547/ T1547] * '''Last Updated''': 2020-11-23
@@ -32348,6 +33953,10 @@ To successfully implement this search, you must be ingesting data that records r | T1547.010 | Port Monitors | Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation |} @@ -32461,7 +34070,7 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/005/ T1218.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/005/ T1218.005] * '''Last Updated''': 2021-07-19
@@ -32519,6 +34128,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.005 | Mshta | Defense Evasion @@ -32556,7 +34169,7 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1574/002/ T1574.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1574/002/ T1574.002], [https://attack.mitre.org/techniques/T1574/ T1574] * '''Last Updated''': 2021-07-05
@@ -32605,6 +34218,10 @@ To successfully implement this search you need to be ingesting information on pr | T1574.002 | DLL Side-Loading | Persistence, Privilege Escalation, Defense Evasion +|- +| T1574 +| Hijack Execution Flow +| Persistence, Privilege Escalation, Defense Evasion |} @@ -32642,7 +34259,7 @@ The analytics returned fields allow analysts to investigate the event further by * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003], [https://attack.mitre.org/techniques/T1110/ T1110] * '''Last Updated''': 2021-04-14
@@ -32689,6 +34306,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle | T1110.003 | Password Spraying | Credential Access +|- +| T1110 +| Brute Force +| Credential Access |} @@ -32726,7 +34347,7 @@ The analytics returned fields allow analysts to investigate the event further by * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003], [https://attack.mitre.org/techniques/T1110/ T1110] * '''Last Updated''': 2021-04-14
@@ -32773,6 +34394,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle | T1110.003 | Password Spraying | Credential Access +|- +| T1110 +| Brute Force +| Credential Access |} @@ -32810,7 +34435,7 @@ The analytics returned fields allow analysts to investigate the event further by * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003], [https://attack.mitre.org/techniques/T1110/ T1110] * '''Last Updated''': 2021-04-15
@@ -32857,6 +34482,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle | T1110.003 | Password Spraying | Credential Access +|- +| T1110 +| Brute Force +| Credential Access |} @@ -32898,7 +34527,7 @@ The analytics returned fields allow analysts to investigate the event further by * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003], [https://attack.mitre.org/techniques/T1110/ T1110] * '''Last Updated''': 2021-04-13
@@ -32948,6 +34577,10 @@ To successfully implement this search, you need to be ingesting Windows Event Lo | T1110.003 | Password Spraying | Credential Access +|- +| T1110 +| Brute Force +| Credential Access |} @@ -32989,7 +34622,7 @@ The analytics returned fields allow analysts to investigate the event further by * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003], [https://attack.mitre.org/techniques/T1110/ T1110] * '''Last Updated''': 2021-04-08
@@ -33036,6 +34669,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle | T1110.003 | Password Spraying | Credential Access +|- +| T1110 +| Brute Force +| Credential Access |} @@ -33077,7 +34714,7 @@ The analytics returned fields allow analysts to investigate the event further by * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003], [https://attack.mitre.org/techniques/T1110/ T1110] * '''Last Updated''': 2021-04-13
@@ -33124,6 +34761,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle | T1110.003 | Password Spraying | Credential Access +|- +| T1110 +| Brute Force +| Credential Access |} @@ -33165,7 +34806,7 @@ The analytics returned fields allow analysts to investigate the event further by * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003], [https://attack.mitre.org/techniques/T1110/ T1110] * '''Last Updated''': 2021-04-13
@@ -33218,6 +34859,10 @@ To successfully implement this search, you need to be ingesting Windows Event Lo | T1110.003 | Password Spraying | Credential Access +|- +| T1110 +| Brute Force +| Credential Access |} @@ -33261,7 +34906,7 @@ The analytics returned fields allow analysts to investigate the event further by * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003], [https://attack.mitre.org/techniques/T1110/ T1110] * '''Last Updated''': 2021-04-13
@@ -33313,6 +34958,10 @@ To successfully implement this search, you need to be ingesting Windows Event Lo | T1110.003 | Password Spraying | Credential Access +|- +| T1110 +| Brute Force +| Credential Access |} @@ -33353,7 +35002,7 @@ This search is to detect modification of registry to bypass UAC windows feature. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2021-07-12
@@ -33398,6 +35047,10 @@ To successfully implement this search you need to be ingesting information on pr | T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion +|- +| T1548 +| Abuse Elevation Control Mechanism +| Privilege Escalation, Defense Evasion |} @@ -33535,7 +35188,7 @@ The following hunting analytic will identify the use of localgroup discovery usi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] * '''Last Updated''': 2021-09-14
@@ -33591,6 +35244,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.001 | Local Groups | Discovery @@ -33903,7 +35560,7 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-03-03
@@ -33959,6 +35616,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -34002,7 +35663,7 @@ This search is to detect an anomaly event of non-chrome process accessing the fi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1555/003/ T1555.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1555/ T1555], [https://attack.mitre.org/techniques/T1555/003/ T1555.003] * '''Last Updated''': 2021-09-15
@@ -34053,6 +35714,10 @@ To successfully implement this search, you must ingest Windows Security Event lo ! Technique ! Tactic |- +| T1555 +| Credentials from Password Stores +| Credential Access +|- | T1555.003 | Credentials from Web Browsers | Credential Access @@ -34086,7 +35751,7 @@ This search is to detect an anomaly event of non-firefox process accessing the f * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1555/003/ T1555.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1555/ T1555], [https://attack.mitre.org/techniques/T1555/003/ T1555.003] * '''Last Updated''': 2021-09-15
@@ -34137,6 +35802,10 @@ To successfully implement this search, you must ingest Windows Security Event lo ! Technique ! Tactic |- +| T1555 +| Credentials from Password Stores +| Credential Access +|- | T1555.003 | Credentials from Web Browsers | Credential Access @@ -34172,7 +35841,7 @@ This technique uses "Install from Media" (IFM), which will extract a cop * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-01-28
@@ -34225,6 +35894,10 @@ You must be ingesting endpoint data that tracks process activity, including pare | T1003.003 | NTDS | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -34265,7 +35938,7 @@ This search is to detect a suspicious MS office application that drop or create * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-09-13
@@ -34313,6 +35986,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -34352,7 +36029,7 @@ this detection was designed to identifies suspicious spawned process of known MS * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-07-30
@@ -34408,6 +36085,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -34445,7 +36126,7 @@ this detection was designed to identifies suspicious spawned process of known MS * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-04-13
@@ -34503,6 +36184,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -34542,7 +36227,7 @@ this search detects a potential malicious office document that create schedule t * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-04-14
@@ -34591,6 +36276,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -34630,7 +36319,7 @@ this detection was designed to identifies suspicious office documents that using * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-04-14
@@ -34683,6 +36372,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -34720,7 +36413,7 @@ This search is to detect potential malicious office document executing lolbin ch * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-09-20
@@ -34776,6 +36469,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -34813,7 +36510,7 @@ this search is to detect a suspicious office product process that spawn cmd chil * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/005/ T1218.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/005/ T1218.005] * '''Last Updated''': 2021-07-19
@@ -34869,6 +36566,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.005 | Mshta | Defense Evasion @@ -34906,7 +36607,7 @@ The following detection identifies the latest behavior utilized by different mal * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-04-26
@@ -34962,6 +36663,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -34999,7 +36704,7 @@ The following detection identifies the latest behavior utilized by different mal * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-04-26
@@ -35055,6 +36760,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -35094,7 +36803,7 @@ The following detection identifies the latest behavior utilized by different mal * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-04-26
@@ -35152,6 +36861,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -35189,7 +36902,7 @@ The following detection identifies the latest behavior utilized by IcedID malwar * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-04-22
@@ -35245,6 +36958,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -35286,7 +37003,7 @@ The following detection identifies the latest behavior utilized by Ursnif malwar * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-09-16
@@ -35344,6 +37061,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -35385,7 +37106,7 @@ The following analytic identifies behavior related to CVE-2021-40444. Whereas th * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-09-10
@@ -35437,6 +37158,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -35480,7 +37205,7 @@ The following detection identifies control.exe spawning from an office product. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-09-08
@@ -35536,6 +37261,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -35583,7 +37312,7 @@ Microsoft Windows contains accessibility features that can be launched with a ke * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/008/ T1546.008] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/ T1546], [https://attack.mitre.org/techniques/T1546/008/ T1546.008] * '''Last Updated''': 2020-07-21
@@ -35625,6 +37354,10 @@ You must be ingesting data that records the filesystem activity from your hosts ! Technique ! Tactic |- +| T1546 +| Event Triggered Execution +| Privilege Escalation, Persistence +|- | T1546.008 | Accessibility Features | Privilege Escalation, Persistence @@ -36007,7 +37740,7 @@ This detection identifies potential Pass the Token or Pass the Hash credential e * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1550/002/ T1550.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1550/ T1550], [https://attack.mitre.org/techniques/T1550/002/ T1550.002] * '''Last Updated''': 2021-09-01
@@ -36060,6 +37793,10 @@ You must be ingesting Windows Security logs from endpoint devices, i.e., destina ! Technique ! Tactic |- +| T1550 +| Use Alternate Authentication Material +| Defense Evasion, Lateral Movement +|- | T1550.002 | Pass the Hash | Defense Evasion, Lateral Movement @@ -36095,7 +37832,7 @@ This detection identifies potential Pass the Token or Pass the Hash credential e * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1550/002/ T1550.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1550/ T1550], [https://attack.mitre.org/techniques/T1550/002/ T1550.002] * '''Last Updated''': 2021-09-01
@@ -36148,6 +37885,10 @@ You must be ingesting Windows Security logs from devices of interest - at least ! Technique ! Tactic |- +| T1550 +| Use Alternate Authentication Material +| Defense Evasion, Lateral Movement +|- | T1550.002 | Pass the Hash | Defense Evasion, Lateral Movement @@ -36183,7 +37924,7 @@ The following Hunting analytic assists with identifying suspicious PowerShell ex * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-08-18
@@ -36392,6 +38133,10 @@ The following Hunting analytic requires PowerShell operational logs to be import ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -36441,7 +38186,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-06-10
@@ -36480,6 +38225,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -36523,7 +38272,7 @@ The following hunting analytic identifies the use of `get-localgroup` being used * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] * '''Last Updated''': 2021-09-14
@@ -36579,6 +38328,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.001 | Local Groups | Discovery @@ -36620,7 +38373,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-06-10
@@ -36663,6 +38416,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -36803,7 +38560,7 @@ The following analytic identifies suspicious PowerShell script execution via Eve * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1027/005/ T1027.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1027/005/ T1027.005] * '''Last Updated''': 2021-06-10
@@ -36844,6 +38601,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1027 +| Obfuscated Files or Information +| Defense Evasion +|- | T1027.005 | Indicator Removal from Tools | Defense Evasion @@ -36889,7 +38650,7 @@ This search is to identifies a modification in registry to disable the windows d * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-07-05
@@ -36950,6 +38711,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -36984,7 +38749,7 @@ This search is to detect a suspicious enabling of smb1protocol through "powe * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1027/005/ T1027.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1027/005/ T1027.005] * '''Last Updated''': 2021-06-22
@@ -37027,6 +38792,10 @@ To successfully implement this search, you need to be ingesting logs with the po ! Technique ! Tactic |- +| T1027 +| Obfuscated Files or Information +| Defense Evasion +|- | T1027.005 | Indicator Removal from Tools | Defense Evasion @@ -37064,7 +38833,7 @@ This search is to detect a COM CLSID execution through powershell. This techniqu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/015/ T1546.015] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/015/ T1546.015], [https://attack.mitre.org/techniques/T1546/ T1546] * '''Last Updated''': 2021-08-10
@@ -37102,6 +38871,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1546.015 | Component Object Model Hijacking | Privilege Escalation, Persistence +|- +| T1546 +| Event Triggered Execution +| Privilege Escalation, Persistence |} @@ -37139,7 +38912,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-06-08
@@ -37182,6 +38955,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1055 | Process Injection | Defense Evasion, Privilege Escalation @@ -37232,7 +39009,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-06-08
@@ -37275,6 +39052,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1027 | Obfuscated Files or Information | Defense Evasion @@ -37326,7 +39107,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] * '''Last Updated''': 2021-09-14
@@ -37367,6 +39148,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.001 | Local Groups | Discovery @@ -37414,7 +39199,7 @@ The following analytic identifies suspicious PowerShell script execution via Eve * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2021-06-10
@@ -37457,6 +39242,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -37754,6 +39543,95 @@ Administrators may modify the boot configuration ignore failure during testing a * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log +''version'': 1 +
+
+ +---- + +===Print processor registry autostart=== +This analytic is to detect a suspicious modification or new registry entry regarding print processor. This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine. This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012], [https://attack.mitre.org/techniques/T1547/ T1547] +* '''Last Updated''': 2021-09-28 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `print_processor_registry_autostart_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Privilege_Escalation|Windows Privilege Escalation]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +====Required field==== + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_path + +* Registry.registry_key_name + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1547.012 +| Print Processors +| Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +possible new printer installation may add driver component on this registry. + +====Reference==== + + +* https://attack.mitre.org/techniques/T1547/012/ + +* https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log + + ''version'': 1
@@ -37767,7 +39645,7 @@ During triage, isolate the endpoint and review for source of exploitation. Captu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012], [https://attack.mitre.org/techniques/T1547/ T1547] * '''Last Updated''': 2021-07-01
@@ -37811,6 +39689,10 @@ You will need to ensure PrintService Admin and Operational logs are being logged | T1547.012 | Print Processors | Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation |} @@ -37854,7 +39736,7 @@ During triage, isolate the endpoint and review for source of exploitation. Captu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012], [https://attack.mitre.org/techniques/T1547/ T1547] * '''Last Updated''': 2021-07-01
@@ -37898,6 +39780,10 @@ You will need to ensure PrintService Admin and Operational logs are being logged | T1547.012 | Print Processors | Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation |} @@ -38015,7 +39901,7 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/002/ T1566.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/002/ T1566.002] * '''Last Updated''': 2021-08-26
@@ -38070,6 +39956,10 @@ You must be ingesting data that records filesystem and process activity from you ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.002 | Spearphishing Link | Initial Access @@ -38282,7 +40172,7 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-05-04
@@ -38341,6 +40231,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -38370,6 +40264,106 @@ Unknown. ---- +===Process writing dynamicwrapperx=== +DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering it into the registry is highly suspect. Why is it needed? In most malicious instances, it will be written to disk at a non-standard location. During triage, review parallel processes and pivot on the process_guid. Review the registry for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious module loads of dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1559/001/ T1559.001] +* '''Last Updated''': 2021-10-05 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user +| `drop_dm_object_name(Processes)` +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="dynwrapx.dll" by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user +| `drop_dm_object_name(Filesystem)` +| fields _time process_guid file_path file_name file_create_time user dest process_name] +| stats count min(_time) as firstTime max(_time) as lastTime by dest process_name process_guid file_name file_path file_create_time user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `process_writing_dynamicwrapperx_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Remcos|Remcos]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +====Required field==== + +* _time + +* dest + +* process_name + +* process_guid + +* file_name + +* file_path + +* file_create_time user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1059 +| Command and Scripting Interpreter +| Execution +|- +| T1559.001 +| Component Object Model +| Execution +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default). + +====Reference==== + + +* https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ + +* https://www.script-coding.com/dynwrapx_eng.html + +* https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ + +* https://tria.ge/210929-ap75vsddan + +* https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Processes tapping keyboard events=== This search looks for processes in an MacOS system that is tapping keyboard events in MacOS, and essentially monitoring all keystrokes made by a user. This is a common technique used by RATs to log keystrokes from a victim, although it can also be used by legitimate processes like Siri to react on human input @@ -38442,7 +40436,7 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/004/ T1562.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/004/ T1562.004], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-09-16
@@ -38495,6 +40489,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.004 | Disable or Modify System Firewall | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -39309,7 +41307,7 @@ This detection identifies access to PowerSploit modules that discover and access * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1007/ T1007], [https://attack.mitre.org/techniques/T1012/ T1012], [https://attack.mitre.org/techniques/T1046/ T1046], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1057/ T1057], [https://attack.mitre.org/techniques/T1083/ T1083], [https://attack.mitre.org/techniques/T1518/ T1518], [https://attack.mitre.org/techniques/T1592/002/ T1592.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1057/ T1057], [https://attack.mitre.org/techniques/T1083/ T1083], [https://attack.mitre.org/techniques/T1592/002/ T1592.002], [https://attack.mitre.org/techniques/T1046/ T1046], [https://attack.mitre.org/techniques/T1012/ T1012], [https://attack.mitre.org/techniques/T1007/ T1007], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1518/ T1518] * '''Last Updated''': 2020-11-06
@@ -39351,22 +41349,6 @@ You must be ingesting Windows Security logs from devices of interest, including ! Technique ! Tactic |- -| T1007 -| System Service Discovery -| Discovery -|- -| T1012 -| Query Registry -| Discovery -|- -| T1046 -| Network Service Scanning -| Discovery -|- -| T1047 -| Windows Management Instrumentation -| Execution -|- | T1057 | Process Discovery | Discovery @@ -39375,13 +41357,33 @@ You must be ingesting Windows Security logs from devices of interest, including | File and Directory Discovery | Discovery |- -| T1518 -| Software Discovery -| Discovery -|- | T1592.002 | Software | Reconnaissance +|- +| T1046 +| Network Service Scanning +| Discovery +|- +| T1012 +| Query Registry +| Discovery +|- +| T1007 +| System Service Discovery +| Discovery +|- +| T1047 +| Windows Management Instrumentation +| Execution +|- +| T1592 +| Gather Victim Host Information +| Reconnaissance +|- +| T1518 +| Software Discovery +| Discovery |} @@ -39499,7 +41501,7 @@ This detection identifies use of Mimikatz modules for discovery and access to ne * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/002/ T1021.002], [https://attack.mitre.org/techniques/T1135/ T1135], [https://attack.mitre.org/techniques/T1039/ T1039] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1039/ T1039], [https://attack.mitre.org/techniques/T1135/ T1135], [https://attack.mitre.org/techniques/T1021/002/ T1021.002] * '''Last Updated''': 2020-11-06
@@ -39541,17 +41543,21 @@ You must be ingesting Windows Security logs from devices of interest, including ! Technique ! Tactic |- -| T1021.002 -| SMB/Windows Admin Shares +| T1021 +| Remote Services | Lateral Movement |- +| T1039 +| Data from Network Shared Drive +| Collection +|- | T1135 | Network Share Discovery | Discovery |- -| T1039 -| Data from Network Shared Drive -| Collection +| T1021.002 +| SMB/Windows Admin Shares +| Lateral Movement |} @@ -39584,7 +41590,7 @@ This detection identifies access to PowerSploit modules that discover and access * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/002/ T1021.002], [https://attack.mitre.org/techniques/T1135/ T1135], [https://attack.mitre.org/techniques/T1039/ T1039] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1039/ T1039], [https://attack.mitre.org/techniques/T1135/ T1135], [https://attack.mitre.org/techniques/T1021/002/ T1021.002] * '''Last Updated''': 2020-11-06
@@ -39626,17 +41632,21 @@ You must be ingesting Windows Security logs from devices of interest, including ! Technique ! Tactic |- -| T1021.002 -| SMB/Windows Admin Shares +| T1021 +| Remote Services | Lateral Movement |- +| T1039 +| Data from Network Shared Drive +| Collection +|- | T1135 | Network Share Discovery | Discovery |- -| T1039 -| Data from Network Shared Drive -| Collection +| T1021.002 +| SMB/Windows Admin Shares +| Lateral Movement |} @@ -39766,7 +41776,7 @@ This detection identifies access to PowerSploit modules for reconnaissance of co * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/002/ T1021.002], [https://attack.mitre.org/techniques/T1135/ T1135], [https://attack.mitre.org/techniques/T1039/ T1039] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1039/ T1039], [https://attack.mitre.org/techniques/T1135/ T1135], [https://attack.mitre.org/techniques/T1021/002/ T1021.002] * '''Last Updated''': 2020-11-06
@@ -39808,17 +41818,21 @@ You must be ingesting Windows Security logs from devices of interest, including ! Technique ! Tactic |- -| T1021.002 -| SMB/Windows Admin Shares +| T1021 +| Remote Services | Lateral Movement |- +| T1039 +| Data from Network Shared Drive +| Collection +|- | T1135 | Network Share Discovery | Discovery |- -| T1039 -| Data from Network Shared Drive -| Collection +| T1021.002 +| SMB/Windows Admin Shares +| Lateral Movement |} @@ -39851,7 +41865,7 @@ This detection identifies reconnaissance of credential stores and use of CryptoA * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1589/001/ T1589.001], [https://attack.mitre.org/techniques/T1590/001/ T1590.001], [https://attack.mitre.org/techniques/T1590/003/ T1590.003], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1590/001/ T1590.001], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1589/001/ T1589.001], [https://attack.mitre.org/techniques/T1590/ T1590], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1589/ T1589], [https://attack.mitre.org/techniques/T1590/003/ T1590.003] * '''Last Updated''': 2020-11-03
@@ -39893,29 +41907,37 @@ You must be ingesting Windows Security logs from devices of interest, including ! Technique ! Tactic |- -| T1589.001 -| Credentials -| Reconnaissance +| T1098 +| Account Manipulation +| Persistence |- | T1590.001 | Domain Properties | Reconnaissance |- -| T1590.003 -| Network Trust Dependencies +| T1078 +| Valid Accounts +| Defense Evasion, Persistence, Privilege Escalation, Initial Access +|- +| T1589.001 +| Credentials +| Reconnaissance +|- +| T1590 +| Gather Victim Network Information | Reconnaissance |- | T1068 | Exploitation for Privilege Escalation | Privilege Escalation |- -| T1078 -| Valid Accounts -| Defense Evasion, Persistence, Privilege Escalation, Initial Access +| T1589 +| Gather Victim Identity Information +| Reconnaissance |- -| T1098 -| Account Manipulation -| Persistence +| T1590.003 +| Network Trust Dependencies +| Reconnaissance |} @@ -39948,7 +41970,7 @@ This detection identifies use of PowerSploit modules for assessment of presence * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1595/002/ T1595.002], [https://attack.mitre.org/techniques/T1592/002/ T1592.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1592/002/ T1592.002], [https://attack.mitre.org/techniques/T1595/002/ T1595.002], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1595/ T1595] * '''Last Updated''': 2020-11-05
@@ -39990,12 +42012,20 @@ You must be ingesting Windows Security logs from devices of interest, including ! Technique ! Tactic |- +| T1592.002 +| Software +| Reconnaissance +|- | T1595.002 | Vulnerability Scanning | Reconnaissance |- -| T1592.002 -| Software +| T1592 +| Gather Victim Host Information +| Reconnaissance +|- +| T1595 +| Active Scanning | Reconnaissance |} @@ -40201,7 +42231,7 @@ This search is to detect a suspicious commandline designed to delete files or di * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/004/ T1070.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/004/ T1070.004], [https://attack.mitre.org/techniques/T1070/ T1070] * '''Last Updated''': 2021-06-22
@@ -40260,6 +42290,10 @@ To successfully implement this search you need to be ingesting information on pr | T1070.004 | File Deletion | Defense Evasion +|- +| T1070 +| Indicator Removal on Host +| Defense Evasion |} @@ -40294,7 +42328,7 @@ The search looks for reg.exe modifying registry keys that define Windows service * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1574/011/ T1574.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1574/011/ T1574.011], [https://attack.mitre.org/techniques/T1574/ T1574] * '''Last Updated''': 2020-11-26
@@ -40345,6 +42379,10 @@ To successfully implement this search, you must be ingesting data that records r | T1574.011 | Services Registry Permissions Weakness | Persistence, Privilege Escalation, Defense Evasion +|- +| T1574 +| Hijack Execution Flow +| Persistence, Privilege Escalation, Defense Evasion |} @@ -40375,7 +42413,7 @@ The search looks for modifications to registry keys that can be used to launch a * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/001/ T1547.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/001/ T1547.001], [https://attack.mitre.org/techniques/T1547/ T1547] * '''Last Updated''': 2021-09-07
@@ -40383,7 +42421,7 @@ The search looks for modifications to registry keys that can be used to launch a ====Search==== -| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` @@ -40436,6 +42474,10 @@ To successfully implement this search, you must be ingesting data that records r | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation |} @@ -40466,7 +42508,7 @@ This search looks for modifications to registry keys that can be used to elevate * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/012/ T1546.012] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/012/ T1546.012], [https://attack.mitre.org/techniques/T1546/ T1546] * '''Last Updated''': 2020-11-27
@@ -40515,6 +42557,10 @@ To successfully implement this search, you must be ingesting data that records r | T1546.012 | Image File Execution Options Injection | Privilege Escalation, Persistence +|- +| T1546 +| Event Triggered Execution +| Privilege Escalation, Persistence |} @@ -40549,7 +42595,7 @@ This search looks for registry activity associated with application compatibilit * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/011/ T1546.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/011/ T1546.011], [https://attack.mitre.org/techniques/T1546/ T1546] * '''Last Updated''': 2020-11-26
@@ -40596,6 +42642,10 @@ To successfully implement this search, you must populate the Change_Analysis dat | T1546.011 | Application Shimming | Privilege Escalation, Persistence +|- +| T1546 +| Event Triggered Execution +| Privilege Escalation, Persistence |} @@ -40621,6 +42671,105 @@ There are many legitimate applications that leverage shim databases for compatib ---- +===Regsvr32 silent param dll loading=== +This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware like remcos, njrat and APT's to load their malicious dll in the compromised machine. This TTP may executed by normal 3rd party application so it is better to pivot the parent process, parent commandline and commandline of the file that execute this regsvr32. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/010/ T1218.010] +* '''Last Updated''': 2021-10-04 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = regsvr32.exe Processes.process="*/i*" Processes.process="*/s*" by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `regsvr32_silent_param_dll_loading_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Regsvr32_Activity|Suspicious Regsvr32 Activity]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- +| T1218.010 +| Regsvr32 +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Other third part application may used this parameter but not so common in base windows environment. + +====Reference==== + + +* https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/# + +* https://attack.mitre.org/techniques/T1218/010/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + + +''version'': 1 +
+
+ +---- + ===Remcos rat file creation in remcos folder=== This search is to detect file creation in remcos folder in appdata which is the keylog and clipboard logs that will be send to its c2 server. This is really a good TTP indicator that there is a remcos rat in the system that do keylogging, clipboard grabbing and audio recording. @@ -40788,7 +42937,7 @@ This search looks for the remote desktop process mstsc.exe running on systems up * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001], [https://attack.mitre.org/techniques/T1021/ T1021] * '''Last Updated''': 2020-07-21
@@ -40835,6 +42984,10 @@ To successfully implement this search, you must be ingesting data that records p | T1021.001 | Remote Desktop Protocol | Lateral Movement +|- +| T1021 +| Remote Services +| Lateral Movement |} @@ -41743,7 +43896,7 @@ This search looks for executing scripts with rundll32. Adversaries may abuse run * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2020-11-30
@@ -41799,6 +43952,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -41832,7 +43989,7 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-09-08
@@ -41888,6 +44045,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -41933,7 +44094,7 @@ The following detection identifies rundll32.exe with `control_rundll` within the * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-09-08
@@ -41989,6 +44150,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -42202,7 +44367,7 @@ This search is to detect a suspicious rundll32.exe process having a http connect * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-07-26
@@ -42247,6 +44412,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -42284,7 +44453,7 @@ This search is to detect a suspicious rundll32 process that drops executable (.e * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-07-26
@@ -42327,6 +44496,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -42359,29 +44532,122 @@ unknown ---- -===Rundll32 with no command line arguments with network=== -The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +===Rundll32 shimcache flush=== +This analytic is to detect a suspicious rundll32 commandline to clear shim cache. This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. This TTP is a good indicator that someone tries to evade some tools and clear foothold on the machine. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] -* '''Last Updated''': 2021-04-19 +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1112/ T1112] +* '''Last Updated''': 2021-10-05
====Search==== -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process = "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `rundll32_shimcache_flush_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Unusual_Processes|Unusual Processes]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1112 +| Modify Registry +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://blueteamops.medium.com/shimcache-flush-89daff28d15e + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log + + +''version'': 1 +
+
+ +---- + +===Rundll32 with no command line arguments with network=== +The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''Last Updated''': 2021-10-13 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(rundll32\.exe.{0,4}$)" -| join process_id [ -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] -| table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port +| table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `rundll32_with_no_command_line_arguments_with_network_filter` ====Associated Analytic Story==== @@ -42430,6 +44696,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -42462,7 +44732,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log -''version'': 2 +''version'': 3
@@ -42546,7 +44816,7 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/003/ T1059.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/003/ T1059.003] * '''Last Updated''': 2021-03-01
@@ -42596,6 +44866,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.003 | Windows Command Shell | Execution @@ -42639,7 +44913,7 @@ The following analytic identifies access to SAM, SYSTEM or SECURITY databases * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-07-23
@@ -42681,6 +44955,10 @@ To successfully implement this search, you must ingest Windows Security Event lo | T1003.002 | Security Account Manager | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -42723,7 +45001,7 @@ The following analytic identifies the Microsoft Software Licensing User Interfac * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2021-05-13
@@ -42776,6 +45054,10 @@ To successfully implement this search you need to be ingesting information on pr | T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion +|- +| T1548 +| Abuse Elevation Control Mechanism +| Privilege Escalation, Defense Evasion |} @@ -42818,7 +45100,7 @@ The following analytic identifies the Microsoft Software Licensing User Interfac * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2021-05-13
@@ -42871,6 +45153,10 @@ To successfully implement this search you need to be ingesting information on pr | T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion +|- +| T1548 +| Abuse Elevation Control Mechanism +| Privilege Escalation, Defense Evasion |} @@ -42984,7 +45270,7 @@ This search looks for arguments to sc.exe indicating the creation or modificatio * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1543/003/ T1543.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1543/003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543] * '''Last Updated''': 2020-07-21
@@ -43041,6 +45327,10 @@ To successfully implement this search you need to be ingesting information on pr | T1543.003 | Windows Service | Persistence, Privilege Escalation +|- +| T1543 +| Create or Modify System Process +| Persistence, Privilege Escalation |} @@ -43071,7 +45361,7 @@ This analytic is to detect an application try to connect and create ADSI Object * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2021-09-07
@@ -43119,6 +45409,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1087.002 | Domain Account | Discovery +|- +| T1087 +| Account Discovery +| Discovery |} @@ -43333,7 +45627,7 @@ This search looks for flags passed to schtasks.exe on the command-line that indi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005], [https://attack.mitre.org/techniques/T1053/ T1053] * '''Last Updated''': 2020-12-17
@@ -43384,6 +45678,10 @@ You must be ingesting endpoint data that tracks process activity, including pare | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation +|- +| T1053 +| Scheduled Task/Job +| Execution, Persistence, Privilege Escalation |} @@ -43497,7 +45795,7 @@ This search looks for flags passed to schtasks.exe on the command-line that indi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005], [https://attack.mitre.org/techniques/T1053/ T1053] * '''Last Updated''': 2020-07-21
@@ -43546,6 +45844,10 @@ You must be ingesting data that records process activity from your hosts to popu | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation +|- +| T1053 +| Scheduled Task/Job +| Execution, Persistence, Privilege Escalation |} @@ -43576,7 +45878,7 @@ This search looks for flags passed to schtasks.exe on the command-line that indi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005], [https://attack.mitre.org/techniques/T1053/ T1053] * '''Last Updated''': 2020-12-07
@@ -43625,6 +45927,10 @@ To successfully implement this search you need to be ingesting information on pr | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation +|- +| T1053 +| Scheduled Task/Job +| Execution, Persistence, Privilege Escalation |} @@ -43650,6 +45956,95 @@ Administrators may create jobs on systems forcing reboots to perform updates, ma ---- +===Screensaver event trigger execution=== +This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/ T1546], [https://attack.mitre.org/techniques/T1546/002/ T1546.002] +* '''Last Updated''': 2021-09-27 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `screensaver_event_trigger_execution_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Privilege_Escalation|Windows Privilege Escalation]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +====Required field==== + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_path + +* Registry.registry_key_name + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1546 +| Event Triggered Execution +| Privilege Escalation, Persistence +|- +| T1546.002 +| Screensaver +| Privilege Escalation, Persistence +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://attack.mitre.org/techniques/T1546/002/ + +* https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log + + +''version'': 1 +
+
+ +---- + ===Script execution via wmi=== This search looks for scripts launched via WMI. @@ -43732,7 +46127,7 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2021-07-01
@@ -43777,6 +46172,10 @@ To successfully implement this search you need to be ingesting information on pr | T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion +|- +| T1548 +| Abuse Elevation Control Mechanism +| Privilege Escalation, Defense Evasion |} @@ -43810,29 +46209,130 @@ Limited to no false positives are expected. ---- -===Searchprotocolhost with no command line with network=== -The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. +===Sdelete application execution=== +This analytic is to detect the execution of sdelete.exe application sysinternal tools. This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. This tool is designed to delete securely a file in file system that remove the forensic evidence on the machine. A good TTP query to check why user execute this application which is not a common practice. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055] -* '''Last Updated''': 2021-04-19 +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1070/004/ T1070.004], [https://attack.mitre.org/techniques/T1070/ T1070] +* '''Last Updated''': 2021-10-06
====Search==== -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_sdelete` by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `sdelete_application_execution_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Masquerading_-_Rename_System_Utilities|Masquerading - Rename System Utilities]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1485 +| Data Destruction +| Impact +|- +| T1070.004 +| File Deletion +| Defense Evasion +|- +| T1070 +| Indicator Removal on Host +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +user may execute and use this application + +====Reference==== + + +* https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log + + +''version'': 1 +
+
+ +---- + +===Searchprotocolhost with no command line with network=== +The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055] +* '''Last Updated''': 2021-10-13 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(searchprotocolhost\.exe.{0,4}$)" -| join process_id [ -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id Ports.dest Ports.dest_port +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] -| table _time dest parent_process_name process_name process_path process process_id connection_to_CNC dest_port +| table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter` ====Associated Analytic Story==== @@ -43891,7 +46391,7 @@ Limited false positives may be present in small environments. Tuning may be requ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log -''version'': 1 +''version'': 2
@@ -43902,7 +46402,7 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/003/ T1003.003], [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2021-05-26
@@ -43955,6 +46455,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1003.003 | NTDS | Credential Access +|- +| T1003 +| OS Credential Dumping +| Credential Access |} @@ -44080,7 +46584,7 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "un * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1059/001/ T1059.001] * '''Last Updated''': 2020-11-06
@@ -44126,6 +46630,10 @@ You must be ingesting data that records process activity from your hosts to popu ! Technique ! Tactic |- +| T1059 +| Command and Scripting Interpreter +| Execution +|- | T1059.001 | PowerShell | Execution @@ -44428,7 +46936,7 @@ This search looks for shim database files being written to default directories. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/011/ T1546.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/011/ T1546.011], [https://attack.mitre.org/techniques/T1546/ T1546] * '''Last Updated''': 2020-12-08
@@ -44473,6 +46981,10 @@ You must be ingesting data that records the filesystem activity from your hosts | T1546.011 | Application Shimming | Privilege Escalation, Persistence +|- +| T1546 +| Event Triggered Execution +| Privilege Escalation, Persistence |} @@ -44503,7 +47015,7 @@ This search detects the process execution and arguments required to silently cre * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/011/ T1546.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/011/ T1546.011], [https://attack.mitre.org/techniques/T1546/ T1546] * '''Last Updated''': 2020-11-23
@@ -44548,6 +47060,10 @@ You must be ingesting data that records process activity from your hosts to popu | T1546.011 | Application Shimming | Privilege Escalation, Persistence +|- +| T1546 +| Event Triggered Execution +| Privilege Escalation, Persistence |} @@ -44578,7 +47094,7 @@ This search detects accounts that were created and deleted in a short time perio * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/001/ T1136.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/001/ T1136.001], [https://attack.mitre.org/techniques/T1136/ T1136] * '''Last Updated''': 2020-07-06
@@ -44624,6 +47140,10 @@ This search requires you to have enabled your Group Management Audit Logs in you | T1136.001 | Local Account | Persistence +|- +| T1136 +| Create Account +| Persistence |} @@ -44656,7 +47176,7 @@ This search is to detect a suspicious modification of registry that may related * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2021-07-01
@@ -44701,6 +47221,10 @@ To successfully implement this search you need to be ingesting information on pr | T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion +|- +| T1548 +| Abuse Elevation Control Mechanism +| Privilege Escalation, Defense Evasion |} @@ -44737,7 +47261,7 @@ This search looks for process names that consist only of a single letter. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/002/ T1204.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1204/002/ T1204.002] * '''Last Updated''': 2020-12-08
@@ -44782,6 +47306,10 @@ You must be ingesting data that records process activity from your hosts to popu ! Technique ! Tactic |- +| T1204 +| User Execution +| Execution +|- | T1204.002 | Malicious File | Execution @@ -44879,7 +47407,7 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012], [https://attack.mitre.org/techniques/T1547/ T1547] * '''Last Updated''': 2021-07-01
@@ -44938,6 +47466,10 @@ To successfully implement this search you need to be ingesting information on pr | T1547.012 | Print Processors | Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation |} @@ -44976,7 +47508,7 @@ This search is to detect suspicious loading of dll in specific path relative to * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012], [https://attack.mitre.org/techniques/T1547/ T1547] * '''Last Updated''': 2021-07-01
@@ -45021,6 +47553,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1547.012 | Print Processors | Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation |} @@ -45141,7 +47677,7 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012], [https://attack.mitre.org/techniques/T1547/ T1547] * '''Last Updated''': 2021-07-01
@@ -45198,6 +47734,10 @@ To successfully implement this search you need to be ingesting information on pr | T1547.012 | Print Processors | Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation |} @@ -45236,7 +47776,7 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/012/ T1547.012], [https://attack.mitre.org/techniques/T1547/ T1547] * '''Last Updated''': 2021-07-01
@@ -45284,6 +47824,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1547.012 | Print Processors | Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation |} @@ -45404,7 +47948,7 @@ This search is to detect a modification or registry add to the safeboot registry * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/001/ T1547.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/001/ T1547.001], [https://attack.mitre.org/techniques/T1547/ T1547] * '''Last Updated''': 2021-06-10
@@ -45449,6 +47993,10 @@ To successfully implement this search, you must be ingesting data that records r | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation |} @@ -45549,6 +48097,103 @@ unknown ====Test Dataset==== +''version'': 1 +
+
+ +---- + +===Suspicious copy on system32=== +This analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate tool in OS. this type of event may seen or may execute of normal user in some instance but this is really a anomaly that needs to be check within the network. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/003/ T1036.003], [https://attack.mitre.org/techniques/T1036/ T1036] +* '''Last Updated''': 2021-10-05 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `suspicious_copy_on_system32_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Unusual_Processes|Unusual Processes]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1036.003 +| Rename System Utilities +| Defense Evasion +|- +| T1036 +| Masquerading +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +every user may do this event but very un-ussual. + +====Reference==== + + +* https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log + + ''version'': 1
@@ -45743,7 +48388,7 @@ This analytic will detect suspicious driver loaded paths. This technique is comm * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1543/003/ T1543.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1543/003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543] * '''Last Updated''': 2021-04-29
@@ -45791,6 +48436,10 @@ To successfully implement this search, you need to be ingesting logs with the dr | T1543.003 | Windows Service | Persistence, Privilege Escalation +|- +| T1543 +| Create or Modify System Process +| Persistence, Privilege Escalation |} @@ -45827,7 +48476,7 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/001/ T1070.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1070/001/ T1070.001] * '''Last Updated''': 2021-06-17
@@ -45868,6 +48517,10 @@ To successfully implement this search, you need to be ingesting Windows event lo ! Technique ! Tactic |- +| T1070 +| Indicator Removal on Host +| Defense Evasion +|- | T1070.001 | Clear Windows Event Logs | Defense Evasion @@ -46007,7 +48660,7 @@ this search is to detect a suspicious regsvr32 commandline "-s" to execu * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/010/ T1218.010] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/010/ T1218.010] * '''Last Updated''': 2021-07-27
@@ -46063,6 +48716,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.010 | Regsvr32 | Defense Evasion @@ -46100,7 +48757,7 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-07-26
@@ -46156,6 +48813,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -46282,7 +48943,7 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1127/001/ T1127.001], [https://attack.mitre.org/techniques/T1036/003/ T1036.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1036/003/ T1036.003], [https://attack.mitre.org/techniques/T1127/001/ T1127.001] * '''Last Updated''': 2021-01-12
@@ -46342,13 +49003,21 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- -| T1127.001 -| MSBuild +| T1036 +| Masquerading +| Defense Evasion +|- +| T1127 +| Trusted Developer Utilities Proxy Execution | Defense Evasion |- | T1036.003 | Rename System Utilities | Defense Evasion +|- +| T1127.001 +| MSBuild +| Defense Evasion |} @@ -46387,7 +49056,7 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1127/001/ T1127.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1127/001/ T1127.001] * '''Last Updated''': 2021-01-12
@@ -46443,6 +49112,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1127 +| Trusted Developer Utilities Proxy Execution +| Defense Evasion +|- | T1127.001 | MSBuild | Defense Evasion @@ -46489,7 +49162,7 @@ Upon triage, capture the property list file being written to disk and review for * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1543/001/ T1543.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1543/001/ T1543.001], [https://attack.mitre.org/techniques/T1543/ T1543] * '''Last Updated''': 2021-02-22
@@ -46540,6 +49213,10 @@ To successfully implement this search you need to be ingesting information on pr | T1543.001 | Launch Agent | Persistence, Privilege Escalation +|- +| T1543 +| Create or Modify System Process +| Persistence, Privilege Escalation |} @@ -46581,7 +49258,7 @@ Upon triage, capture the property list file being written to disk and review for * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1543/001/ T1543.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1543/001/ T1543.001], [https://attack.mitre.org/techniques/T1543/ T1543] * '''Last Updated''': 2021-02-22
@@ -46616,6 +49293,10 @@ OSQuery must be installed and configured to pick up process events (info at http | T1543.001 | Launch Agent | Persistence, Privilege Escalation +|- +| T1543 +| Create or Modify System Process +| Persistence, Privilege Escalation |} @@ -46834,7 +49515,7 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/010/ T1218.010] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/010/ T1218.010] * '''Last Updated''': 2021-01-28
@@ -46892,6 +49573,10 @@ You must be ingesting endpoint data that tracks process activity, including pare ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.010 | Regsvr32 | Defense Evasion @@ -46937,7 +49622,7 @@ This search is to detect a suspicious rundll32.exe process with plugininit param * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-07-26
@@ -46993,6 +49678,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -47030,7 +49719,7 @@ The following analytic identifies renamed instances of rundll32.exe executing. r * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011], [https://attack.mitre.org/techniques/T1036/003/ T1036.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1218/011/ T1218.011], [https://attack.mitre.org/techniques/T1036/003/ T1036.003] * '''Last Updated''': 2021-02-04
@@ -47088,6 +49777,14 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- +| T1036 +| Masquerading +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -47133,7 +49830,7 @@ The following analytic identifies rundll32.exe executing a DLL function name, St * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-02-04
@@ -47193,6 +49890,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -47238,7 +49939,7 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-02-09
@@ -47294,6 +49995,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -47343,7 +50048,7 @@ The following analytic identifies rundll32.exe with no command line arguments. I * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/011/ T1218.011] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/011/ T1218.011] * '''Last Updated''': 2021-09-20
@@ -47404,6 +50109,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.011 | Rundll32 | Defense Evasion @@ -47532,7 +50241,7 @@ The following detection identifies Scheduled Tasks registering (creating a new t * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005], [https://attack.mitre.org/techniques/T1053/ T1053] * '''Last Updated''': 2021-03-01
@@ -47589,6 +50298,10 @@ To successfully implement this search you need to be ingesting information on pr | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation +|- +| T1053 +| Scheduled Task/Job +| Execution, Persistence, Privilege Escalation |} @@ -47808,7 +50521,7 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1036/003/ T1036.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1036/003/ T1036.003] * '''Last Updated''': 2021-09-20
@@ -47868,6 +50581,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1036 +| Masquerading +| Defense Evasion +|- | T1127 | Trusted Developer Utilities Proxy Execution | Defense Evasion @@ -48006,7 +50723,7 @@ The following analytic identifies msbuild.exe executing from a non-standard path * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1127/001/ T1127.001], [https://attack.mitre.org/techniques/T1036/003/ T1036.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1036/003/ T1036.003], [https://attack.mitre.org/techniques/T1127/001/ T1127.001] * '''Last Updated''': 2021-01-12
@@ -48066,13 +50783,21 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- -| T1127.001 -| MSBuild +| T1036 +| Masquerading +| Defense Evasion +|- +| T1127 +| Trusted Developer Utilities Proxy Execution | Defense Evasion |- | T1036.003 | Rename System Utilities | Defense Evasion +|- +| T1127.001 +| MSBuild +| Defense Evasion |} @@ -48109,7 +50834,7 @@ The following analytic identifies child processes spawning from "mshta.exe& * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/005/ T1218.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/005/ T1218.005] * '''Last Updated''': 2021-01-12
@@ -48155,6 +50880,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.005 | Mshta | Defense Evasion @@ -48194,7 +50923,7 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/005/ T1218.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/005/ T1218.005] * '''Last Updated''': 2021-01-20
@@ -48250,6 +50979,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.005 | Mshta | Defense Evasion @@ -48287,19 +51020,19 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg ---- ===Suspicious wevtutil usage=== -The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, or system event logs. +The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, trace or system event logs. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/001/ T1070.001] -* '''Last Updated''': 2020-07-22 +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/001/ T1070.001], [https://attack.mitre.org/techniques/T1070/ T1070] +* '''Last Updated''': 2021-10-11
====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = wevtutil.exe Processes.process="*cl*" (Processes.process="*System*" OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") (Processes.process="*System*" OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*" OR Processes.process="*trace*") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` @@ -48342,6 +51075,10 @@ You must be ingesting data that records process activity from your hosts to popu | T1070.001 | Clear Windows Event Logs | Defense Evasion +|- +| T1070 +| Indicator Removal on Host +| Defense Evasion |} @@ -48356,12 +51093,16 @@ The wevtutil.exe application is a legitimate Windows event log utility. Administ ====Reference==== +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + + + ====Test Dataset==== * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-sysmon.log -''version'': 3 +''version'': 4
@@ -48643,7 +51384,7 @@ During triage, review the parallel processes - what process moved the native Win * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/003/ T1036.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1036/003/ T1036.003] * '''Last Updated''': 2020-12-08
@@ -48698,6 +51439,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1036 +| Masquerading +| Defense Evasion +|- | T1036.003 | Rename System Utilities | Defense Evasion @@ -48912,6 +51657,95 @@ Administrators or power users may use this command for troubleshooting. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log +''version'': 1 +
+
+ +---- + +===Time provider persistence registry=== +This analytic is to detect a suspiciouos modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/003/ T1547.003], [https://attack.mitre.org/techniques/T1547/ T1547] +* '''Last Updated''': 2021-09-29 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `time_provider_persistence_registry_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Privilege_Escalation|Windows Privilege Escalation]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. + +====Required field==== + +* _time + +* Registry.dest + +* Registry.user + +* Registry.registry_path + +* Registry.registry_key_name + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1547.003 +| Time Providers +| Persistence, Privilege Escalation +|- +| T1547 +| Boot or Logon Autostart Execution +| Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://pentestlab.blog/2019/10/22/persistence-time-providers/ + +* https://attack.mitre.org/techniques/T1547/003/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log + + ''version'': 1
@@ -49009,7 +51843,7 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2021-07-12
@@ -49061,6 +51895,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion +|- +| T1548 +| Abuse Elevation Control Mechanism +| Privilege Escalation, Defense Evasion |} @@ -49095,7 +51933,7 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/003/ T1218.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/003/ T1218.003] * '''Last Updated''': 2021-08-13
@@ -49142,6 +51980,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.003 | CMSTP | Defense Evasion @@ -49350,7 +52192,7 @@ This search is to detect a suspicious un-installation of application using msiex * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/007/ T1218.007] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/007/ T1218.007], [https://attack.mitre.org/techniques/T1218/ T1218] * '''Last Updated''': 2021-08-09
@@ -49403,6 +52245,10 @@ To successfully implement this search, you need to be ingesting logs with the pr | T1218.007 | Msiexec | Defense Evasion +|- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion |} @@ -49437,7 +52283,7 @@ Attackers often disable security tools to avoid detection. This search looks for * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2020-07-22
@@ -49487,6 +52333,10 @@ You must be ingesting data that records process activity from your hosts to popu | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -49987,6 +52837,204 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell.log +''version'': 1 +
+
+ +---- + +===Vbscript execution using wscript app=== +This analytic is to detect a suspicious wscript commandline to execute vbscript. This technique was seen in several malware to execute malicious vbs file using wscript application. commonly vbs script is associated to cscript process and this can be a technique to evade process parent child detections or even some av script emulation system. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/005/ T1059.005], [https://attack.mitre.org/techniques/T1059/ T1059] +* '''Last Updated''': 2021-10-01 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "wscript.exe" AND Processes.parent_process = "*//e:vbscript*") OR (Processes.process_name = "wscript.exe" AND Processes.process = "*//e:vbscript*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_id Processes.process Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `vbscript_execution_using_wscript_app_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#FIN7|FIN7]] + +* [[Documentation:ESSOC:stories:UseCase#Remcos|Remcos]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1059.005 +| Visual Basic +| Execution +|- +| T1059 +| Command and Scripting Interpreter +| Execution +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://www.joesandbox.com/analysis/369332/0/html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + + +''version'': 1 +
+
+ +---- + +===Verclsid clsid execution=== +This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. This hunting query can be a good pivot point to analyze what is he CLSID or COM object pointing too to check if it is a valid application or not. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/012/ T1218.012], [https://attack.mitre.org/techniques/T1218/ T1218] +* '''Last Updated''': 2021-09-29 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_verclsid` AND Processes.process="*/S*" Processes.process="*/C*" AND Processes.process="*{*" AND Processes.process="*}*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name Processes.parent_process +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `verclsid_clsid_execution_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Unusual_Processes|Unusual Processes]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1218.012 +| Verclsid +| Defense Evasion +|- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +windows can used this application for its normal COM object validation. + +====Reference==== + + +* https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5 + +* https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log + + ''version'': 1
@@ -49998,7 +53046,7 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1505/003/ T1505.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1505/ T1505], [https://attack.mitre.org/techniques/T1505/003/ T1505.003] * '''Last Updated''': 2021-03-03
@@ -50056,6 +53104,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1505 +| Server Software Component +| Persistence +|- | T1505.003 | Web Shell | Persistence @@ -50269,7 +53321,7 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/003/ T1546.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1546/003/ T1546.003], [https://attack.mitre.org/techniques/T1546/ T1546] * '''Last Updated''': 2020-12-08
@@ -50320,6 +53372,10 @@ To successfully implement this search, you must be collecting Sysmon data using | T1546.003 | Windows Management Instrumentation Event Subscription | Privilege Escalation, Persistence +|- +| T1546 +| Event Triggered Execution +| Privilege Escalation, Persistence |} @@ -50517,7 +53573,7 @@ This search is to detect a suspicious modification of registry related to UAC by * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2021-07-01
@@ -50562,6 +53618,10 @@ To successfully implement this search you need to be ingesting information on pr | T1548.002 | Bypass User Account Control | Privilege Escalation, Defense Evasion +|- +| T1548 +| Abuse Elevation Control Mechanism +| Privilege Escalation, Defense Evasion |} @@ -50598,7 +53658,7 @@ this search is designed to detect potential malicious process loading COM object * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/003/ T1218.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/ T1218], [https://attack.mitre.org/techniques/T1218/003/ T1218.003] * '''Last Updated''': 2021-06-02
@@ -50651,6 +53711,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1218 +| Signed Binary Proxy Execution +| Defense Evasion +|- | T1218.003 | CMSTP | Defense Evasion @@ -50690,7 +53754,7 @@ this search is designed to detect suspicious wermgr.exe process that tries to co * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1590/005/ T1590.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1590/ T1590], [https://attack.mitre.org/techniques/T1590/005/ T1590.005] * '''Last Updated''': 2021-04-19
@@ -50739,6 +53803,10 @@ To successfully implement this search, you need to be ingesting logs with the pr ! Technique ! Tactic |- +| T1590 +| Gather Victim Network Information +| Reconnaissance +|- | T1590.005 | IP Addresses | Reconnaissance @@ -50957,7 +54025,7 @@ The wevtutil.exe application is the windows event log utility. This searches for * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/001/ T1070.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1070/001/ T1070.001] * '''Last Updated''': 2021-06-15
@@ -51007,6 +54075,10 @@ You must be ingesting data that records process activity from your hosts to popu ! Technique ! Tactic |- +| T1070 +| Indicator Removal on Host +| Defense Evasion +|- | T1070.001 | Clear Windows Event Logs | Defense Evasion @@ -51044,7 +54116,7 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq * '''Product''': Splunk Behavioral Analytics * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/001/ T1070.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1070/001/ T1070.001] * '''Last Updated''': 2021-06-15
@@ -51092,6 +54164,10 @@ You must be ingesting data that records process activity from your hosts to popu ! Technique ! Tactic |- +| T1070 +| Indicator Removal on Host +| Defense Evasion +|- | T1070.001 | Clear Windows Event Logs | Defense Evasion @@ -51133,7 +54209,7 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005], [https://attack.mitre.org/techniques/T1053/ T1053] * '''Last Updated''': 2021-04-08
@@ -51185,6 +54261,10 @@ To successfully implement this search, you need to be ingesting Windows Security | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation +|- +| T1053 +| Scheduled Task/Job +| Execution, Persistence, Privilege Escalation |} @@ -51231,7 +54311,7 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/005/ T1053.005], [https://attack.mitre.org/techniques/T1053/ T1053] * '''Last Updated''': 2021-04-12
@@ -51281,6 +54361,10 @@ To successfully implement this search, you need to be ingesting Windows Security | T1053.005 | Scheduled Task | Execution, Persistence, Privilege Escalation +|- +| T1053 +| Scheduled Task/Job +| Execution, Persistence, Privilege Escalation |} @@ -51501,7 +54585,7 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562/001/ T1562.001], [https://attack.mitre.org/techniques/T1562/ T1562] * '''Last Updated''': 2021-03-02
@@ -51550,6 +54634,10 @@ To successfully implement this search you need to be ingesting information on pr | T1562.001 | Disable or Modify Tools | Defense Evasion +|- +| T1562 +| Impair Defenses +| Defense Evasion |} @@ -51584,7 +54672,7 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/001/ T1070.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1070/001/ T1070.001] * '''Last Updated''': 2020-07-06
@@ -51625,6 +54713,10 @@ To successfully implement this search, you need to be ingesting Windows event lo ! Technique ! Tactic |- +| T1070 +| Indicator Removal on Host +| Defense Evasion +|- | T1070.001 | Clear Windows Event Logs | Defense Evasion @@ -51734,6 +54826,103 @@ SAM is a critical windows service, stopping it would cause major issues on an en * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ryuk/windows-sysmon.log +''version'': 1 +
+
+ +---- + +===Winhlp32 spawning a process=== +The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the ".hlp" file name extension. This particular instance is related to a Remcos sample where dynwrapx.dll is added to the registry under inprocserver32, and later module loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During triage, review parallel processes to identify further suspicious behavior. Review module loads for unsuspecting unsigned modules. Capture any file modifications and analyze. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055] +* '''Last Updated''': 2021-10-05 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winhlp32.exe Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `winhlp32_spawning_a_process_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Remcos|Remcos]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1055 +| Process Injection +| Defense Evasion, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +False positives should be limited as winhlp32.exe is typically not used with the latest flavors of Windows OS. However, filter as needed. + +====Reference==== + + +* https://www.exploit-db.com/exploits/16541 + +* https://tria.ge/210929-ap75vsddan + +* https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log + + ''version'': 1
@@ -51745,7 +54934,7 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-04-22
@@ -51801,6 +54990,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -51838,7 +55031,7 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-04-12
@@ -51894,6 +55087,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -51937,7 +55134,7 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/001/ T1566.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566], [https://attack.mitre.org/techniques/T1566/001/ T1566.001] * '''Last Updated''': 2021-04-12
@@ -51983,6 +55180,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1566 +| Phishing +| Initial Access +|- | T1566.001 | Spearphishing Attachment | Initial Access @@ -52022,7 +55223,7 @@ During triage, review parallel processes and identify any further suspicious beh * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/001/ T1069.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1069/ T1069], [https://attack.mitre.org/techniques/T1069/001/ T1069.001] * '''Last Updated''': 2021-09-14
@@ -52078,6 +55279,10 @@ To successfully implement this search you need to be ingesting information on pr ! Technique ! Tactic |- +| T1069 +| Permission Groups Discovery +| Discovery +|- | T1069.001 | Local Groups | Discovery @@ -52117,7 +55322,7 @@ This search is to detect suspicious dropping or creating an executable file in k * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/002/ T1021.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1021/002/ T1021.002] * '''Last Updated''': 2021-04-23
@@ -52166,6 +55371,10 @@ To successfully implement this search, you need to be ingesting Windows Security ! Technique ! Tactic |- +| T1021 +| Remote Services +| Lateral Movement +|- | T1021.002 | SMB/Windows Admin Shares | Lateral Movement @@ -52194,6 +55403,115 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log +''version'': 1 +
+
+ +---- + +===Wscript or cscript suspicious child process=== +This analytic is to detect a suspicious spawned process by wscript or cscript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other script like powershell or create a suspended process to inject its code as a defense evasion. This TTP may detect some normal script that using several application tool that are in the list of the child process it detects but a good pivot and indicator that a script is may execute suspicious code. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1134/004/ T1134.004], [https://attack.mitre.org/techniques/T1134/ T1134] +* '''Last Updated''': 2021-10-06 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("cscript.exe", "wscript.exe") Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wscript_or_cscript_suspicious_child_process_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#FIN7|FIN7]] + +* [[Documentation:ESSOC:stories:UseCase#Remcos|Remcos]] + +* [[Documentation:ESSOC:stories:UseCase#Unusual_Processes|Unusual Processes]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process_name + +* Processes.parent_process + +* Processes.original_file_name + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_path + +* Processes.process_path + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1055 +| Process Injection +| Defense Evasion, Privilege Escalation +|- +| T1543 +| Create or Modify System Process +| Persistence, Privilege Escalation +|- +| T1134.004 +| Parent PID Spoofing +| Defense Evasion, Privilege Escalation +|- +| T1134 +| Access Token Manipulation +| Defense Evasion, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +user may create vbs or js script that use several tool as part of its execution. + +====Reference==== + + +* https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + + ''version'': 1
@@ -52205,7 +55523,7 @@ This analytic identifies XMRIG coinminer driver installation on the system. The * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1543/003/ T1543.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1543/003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543] * '''Last Updated''': 2021-04-29
@@ -52253,6 +55571,10 @@ To successfully implement this search, you need to be ingesting logs with the dr | T1543.003 | Windows Service | Persistence, Privilege Escalation +|- +| T1543 +| Create or Modify System Process +| Persistence, Privilege Escalation |} @@ -52379,7 +55701,7 @@ This search allows you to identify DNS requests that are unusually large for the * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Resolution -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1071/004/ T1071.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1071/004/ T1071.004], [https://attack.mitre.org/techniques/T1071/ T1071] * '''Last Updated''': 2020-01-22
@@ -52441,6 +55763,10 @@ Detailed documentation on how to create a new field within Incident Review may b | T1071.004 | DNS | Command And Control +|- +| T1071 +| Application Layer Protocol +| Command And Control |} @@ -52469,7 +55795,7 @@ This search allows you to identify DNS requests and compute the standard deviati * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Resolution -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003], [https://attack.mitre.org/techniques/T1048/ T1048] * '''Last Updated''': 2021-10-06
@@ -52519,6 +55845,10 @@ To successfully implement this search, you will need to ensure that DNS data is | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration +|- +| T1048 +| Exfiltration Over Alternative Protocol +| Exfiltration |} @@ -52549,7 +55879,7 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1557/002/ T1557.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1557/ T1557], [https://attack.mitre.org/techniques/T1557/002/ T1557.002] * '''Last Updated''': 2020-08-11
@@ -52605,6 +55935,10 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne | Network Denial of Service | Impact |- +| T1557 +| Man-in-the-Middle +| Credential Access, Collection +|- | T1557.002 | ARP Cache Poisoning | Credential Access, Collection @@ -52640,7 +55974,7 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1557/002/ T1557.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1557/ T1557], [https://attack.mitre.org/techniques/T1557/002/ T1557.002] * '''Last Updated''': 2020-10-28
@@ -52704,6 +56038,10 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne | Network Denial of Service | Impact |- +| T1557 +| Man-in-the-Middle +| Credential Access, Collection +|- | T1557.002 | ARP Cache Poisoning | Credential Access, Collection @@ -52837,7 +56175,7 @@ This search looks for outbound SMB connections made by hosts within your network * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1071/002/ T1071.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1071/002/ T1071.002], [https://attack.mitre.org/techniques/T1071/ T1071] * '''Last Updated''': 2020-07-21
@@ -52892,6 +56230,10 @@ In order to run this search effectively, we highly recommend that you leverage t | T1071.002 | File Transfer Protocols | Command And Control +|- +| T1071 +| Application Layer Protocol +| Command And Control |} @@ -52922,7 +56264,7 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1557/002/ T1557.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1557/ T1557], [https://attack.mitre.org/techniques/T1557/002/ T1557.002] * '''Last Updated''': 2020-10-28
@@ -52984,6 +56326,10 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne | Network Denial of Service | Impact |- +| T1557 +| Man-in-the-Middle +| Credential Access, Collection +|- | T1557.002 | ARP Cache Poisoning | Credential Access, Collection @@ -53196,7 +56542,7 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1542/005/ T1542.005] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1542/005/ T1542.005], [https://attack.mitre.org/techniques/T1542/ T1542] * '''Last Updated''': 2020-10-28
@@ -53245,6 +56591,10 @@ This search looks for Network Traffic events to TFTP, FTP or SSH/SCP ports from | T1542.005 | TFTP Boot | Defense Evasion, Persistence +|- +| T1542 +| Pre-OS Boot +| Defense Evasion, Persistence |} @@ -53273,7 +56623,7 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1020/001/ T1020.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1020/001/ T1020.001] * '''Last Updated''': 2020-10-28
@@ -53316,6 +56666,10 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne | Hardware Additions | Initial Access |- +| T1020 +| Automated Exfiltration +| Exfiltration +|- | T1498 | Network Denial of Service | Impact @@ -53740,7 +57094,7 @@ This search identifies DNS query failures by counting the number of DNS response * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Resolution -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1071/004/ T1071.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1071/004/ T1071.004], [https://attack.mitre.org/techniques/T1071/ T1071] * '''Last Updated''': 2020-07-21
@@ -53790,6 +57144,10 @@ To successfully implement this search you must ensure that DNS data is populatin | T1071.004 | DNS | Command And Control +|- +| T1071 +| Application Layer Protocol +| Command And Control |} @@ -53818,7 +57176,7 @@ This search looks for an increase of data transfers from your email server to yo * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/002/ T1114.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/002/ T1114.002], [https://attack.mitre.org/techniques/T1114/ T1114] * '''Last Updated''': 2020-07-21
@@ -53865,6 +57223,10 @@ This search requires you to be ingesting your network traffic and populating the | T1114.002 | Remote Email Collection | Collection +|- +| T1114 +| Email Collection +| Collection |} @@ -53893,7 +57255,7 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Resolution -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1498/002/ T1498.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1498/002/ T1498.002] * '''Last Updated''': 2017-09-20
@@ -53932,6 +57294,10 @@ To successfully implement this search you must ensure that DNS data is populatin ! Technique ! Tactic |- +| T1498 +| Network Denial of Service +| Impact +|- | T1498.002 | Reflection Amplification | Impact @@ -53963,7 +57329,7 @@ This search is designed to detect high frequency of archive files data exfiltrat * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003], [https://attack.mitre.org/techniques/T1048/ T1048] * '''Last Updated''': 2021-04-21
@@ -54022,6 +57388,10 @@ To successfully implement this search, you need to be ingesting logs with the st | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration +|- +| T1048 +| Exfiltration Over Alternative Protocol +| Exfiltration |} @@ -54060,7 +57430,7 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003], [https://attack.mitre.org/techniques/T1048/ T1048] * '''Last Updated''': 2021-04-22
@@ -54110,6 +57480,10 @@ To successfully implement this search, you need to be ingesting logs with the st | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration +|- +| T1048 +| Exfiltration Over Alternative Protocol +| Exfiltration |} @@ -54225,7 +57599,7 @@ This search looks for network traffic on common ports where a higher layer proto * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003], [https://attack.mitre.org/techniques/T1048/ T1048] * '''Last Updated''': 2020-07-21
@@ -54272,6 +57646,10 @@ Running this search properly requires a technology that can inspect network traf | T1048.003 | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration +|- +| T1048 +| Exfiltration Over Alternative Protocol +| Exfiltration |} @@ -54374,7 +57752,7 @@ This search looks for RDP application network traffic and filters any source/des * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001], [https://attack.mitre.org/techniques/T1021/ T1021] * '''Last Updated''': 2020-07-21
@@ -54422,6 +57800,10 @@ You must ensure that your network traffic data is populating the Network_Traffic | T1021.001 | Remote Desktop Protocol | Lateral Movement +|- +| T1021 +| Remote Services +| Lateral Movement |} @@ -54452,7 +57834,7 @@ This search looks for network traffic on TCP/3389, the default port used by remo * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/001/ T1021.001], [https://attack.mitre.org/techniques/T1021/ T1021] * '''Last Updated''': 2020-07-07
@@ -54507,6 +57889,10 @@ To successfully implement this search you need to identify systems that commonly | T1021.001 | Remote Desktop Protocol | Lateral Movement +|- +| T1021 +| Remote Services +| Lateral Movement |} @@ -54535,7 +57921,7 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/002/ T1021.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/002/ T1021.002], [https://attack.mitre.org/techniques/T1021/ T1021] * '''Last Updated''': 2020-07-22
@@ -54587,6 +57973,10 @@ This search requires you to be ingesting your network traffic logs and populatin | T1021.002 | SMB/Windows Admin Shares | Lateral Movement +|- +| T1021 +| Remote Services +| Lateral Movement |} @@ -54615,7 +58005,7 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/002/ T1021.002] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/002/ T1021.002], [https://attack.mitre.org/techniques/T1021/ T1021] * '''Last Updated''': 2020-07-22
@@ -54674,6 +58064,10 @@ Detailed documentation on how to create a new field within Incident Review is fo | T1021.002 | SMB/Windows Admin Shares | Lateral Movement +|- +| T1021 +| Remote Services +| Lateral Movement |} @@ -54702,7 +58096,7 @@ This search looks for network traffic identified as The Onion Router (TOR), a be * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1071/001/ T1071.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1071/ T1071], [https://attack.mitre.org/techniques/T1071/001/ T1071.001] * '''Last Updated''': 2020-07-22
@@ -54752,6 +58146,10 @@ In order to properly run this search, Splunk needs to ingest data from firewalls ! Technique ! Tactic |- +| T1071 +| Application Layer Protocol +| Command And Control +|- | T1071.001 | Web Protocols | Command And Control @@ -55283,7 +58681,7 @@ There might be false positives associted with this detection since items like ar 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-10-14 15:40:37.024104 UTC''
+# On Date: 2021-10-27 10:32:03.863986 UTC''
 # Author: Splunk Security Research''
 # Contact: research@splunk.com''
 #############
diff --git a/docs/index.markdown b/docs/index.markdown
index 2a7fc944a3..a15fd25865 100644
--- a/docs/index.markdown
+++ b/docs/index.markdown
@@ -9,12 +9,12 @@ header:
   actions:
     - label: "Download"
       url: "https://splunkbase.splunk.com/app/3449/"
-excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **637** detections for Splunk."
+excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **658** detections for Splunk."
 feature_row:
   - image_path: /static/feature_detection.png
     alt: "customizable"
     title: "Detections"
-    excerpt: "See all **637** Splunk Analytics built to find evil 😈."
+    excerpt: "See all **658** Splunk Analytics built to find evil 😈."
     url: "/detections"
     btn_class: "btn--primary"
     btn_label: "Explore"
diff --git a/docs/stories.wiki b/docs/stories.wiki
index aba2d27089..131ddd59df 100644
--- a/docs/stories.wiki
+++ b/docs/stories.wiki
@@ -84,10 +84,13 @@ DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it respond
 | [[Documentation:ESSOC:detections:Detections#Large_volume_of_dns_any_queries|Large Volume of DNS ANY Queries]]
 
 |
+[https://attack.mitre.org/techniques/T1498/ T1498], 
 [https://attack.mitre.org/techniques/T1498.002/ T1498.002]
 |
+Network Denial of Service, 
 Reflection Amplification
 |
+Impact, 
 Impact
 
 | Anomaly
@@ -186,10 +189,13 @@ Detect activities and various techniques associated with the abuse of `netsh.exe
 | [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]
 
 |
-[https://attack.mitre.org/techniques/T1562.004/ T1562.004]
+[https://attack.mitre.org/techniques/T1562.004/ T1562.004], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify System Firewall
+Disable or Modify System Firewall, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -242,10 +248,13 @@ Monitor for activities and techniques associated with Discovery and Reconnaissan
 | [[Documentation:ESSOC:detections:Detections#Adsisearcher_account_discovery|AdsiSearcher Account Discovery]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -264,10 +273,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Domain_account_discovery_with_net_app|Domain Account Discovery With Net App]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -275,10 +287,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Domain_account_discovery_with_dsquery|Domain Account Discovery with Dsquery]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -286,10 +301,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Domain_account_discovery_with_wmic|Domain Account Discovery with Wmic]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -319,10 +337,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Domain_group_discovery_with_dsquery|Domain Group Discovery With Dsquery]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -330,10 +351,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Domain_group_discovery_with_net|Domain Group Discovery With Net]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -341,10 +365,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Domain_group_discovery_with_wmic|Domain Group Discovery With Wmic]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -352,10 +379,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Domain_group_discovery_with_adsisearcher|Domain Group Discovery with Adsisearcher]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -363,10 +393,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Elevated_group_discovery_with_net|Elevated Group Discovery With Net]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -374,10 +407,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Elevated_group_discovery_with_wmic|Elevated Group Discovery With Wmic]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -385,10 +421,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Elevated_group_discovery_with_powerview|Elevated Group Discovery with PowerView]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -418,10 +457,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Get_aduser_with_powershell|Get ADUser with PowerShell]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -429,10 +471,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Get_aduser_with_powershell_script_block|Get ADUser with PowerShell Script Block]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -484,10 +529,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Get_domainuser_with_powershell|Get DomainUser with PowerShell]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -495,10 +543,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Get_domainuser_with_powershell_script_block|Get DomainUser with PowerShell Script Block]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -506,10 +557,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Get_wmiobject_group_discovery|Get WMIObject Group Discovery]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.001/ T1069.001]
 |
+Permission Groups Discovery, 
 Local Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -517,10 +571,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Get_wmiobject_group_discovery_with_script_block_logging|Get WMIObject Group Discovery with Script Block Logging]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.001/ T1069.001]
 |
+Permission Groups Discovery, 
 Local Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -594,10 +651,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getadgroup_with_powershell|GetAdGroup with PowerShell]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -605,10 +665,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getadgroup_with_powershell_script_block|GetAdGroup with PowerShell Script Block]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -682,10 +745,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getdomaingroup_with_powershell|GetDomainGroup with PowerShell]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -693,10 +759,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getdomaingroup_with_powershell_script_block|GetDomainGroup with PowerShell Script Block]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -704,10 +773,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getlocaluser_with_powershell|GetLocalUser with PowerShell]]
 
 |
+[https://attack.mitre.org/techniques/T1087/ T1087], 
 [https://attack.mitre.org/techniques/T1087.001/ T1087.001]
 |
+Account Discovery, 
 Local Account
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -715,10 +787,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getlocaluser_with_powershell_script_block|GetLocalUser with PowerShell Script Block]]
 
 |
+[https://attack.mitre.org/techniques/T1087/ T1087], 
 [https://attack.mitre.org/techniques/T1087.001/ T1087.001]
 |
+Account Discovery, 
 Local Account
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -748,10 +823,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getwmiobject_ds_user_with_powershell|GetWmiObject DS User with PowerShell]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -759,10 +837,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getwmiobject_ds_user_with_powershell_script_block|GetWmiObject DS User with PowerShell Script Block]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -792,10 +873,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getwmiobject_ds_group_with_powershell|GetWmiObject Ds Group with PowerShell]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -803,10 +887,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getwmiobject_ds_group_with_powershell_script_block|GetWmiObject Ds Group with PowerShell Script Block]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002]
 |
+Permission Groups Discovery, 
 Domain Groups
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -814,10 +901,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getwmiobject_user_account_with_powershell|GetWmiObject User Account with PowerShell]]
 
 |
+[https://attack.mitre.org/techniques/T1087/ T1087], 
 [https://attack.mitre.org/techniques/T1087.001/ T1087.001]
 |
+Account Discovery, 
 Local Account
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -825,10 +915,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Getwmiobject_user_account_with_powershell_script_block|GetWmiObject User Account with PowerShell Script Block]]
 
 |
+[https://attack.mitre.org/techniques/T1087/ T1087], 
 [https://attack.mitre.org/techniques/T1087.001/ T1087.001]
 |
+Account Discovery, 
 Local Account
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -836,10 +929,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Local_account_discovery_with_wmic|Local Account Discovery With Wmic]]
 
 |
+[https://attack.mitre.org/techniques/T1087/ T1087], 
 [https://attack.mitre.org/techniques/T1087.001/ T1087.001]
 |
+Account Discovery, 
 Local Account
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -847,10 +943,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Local_account_discovery_with_net|Local Account Discovery with Net]]
 
 |
+[https://attack.mitre.org/techniques/T1087/ T1087], 
 [https://attack.mitre.org/techniques/T1087.001/ T1087.001]
 |
+Account Discovery, 
 Local Account
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -869,10 +968,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Net_localgroup_discovery|Net Localgroup Discovery]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.001/ T1069.001]
 |
+Permission Groups Discovery, 
 Local Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -924,10 +1026,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Powershell_get_localgroup_discovery|PowerShell Get LocalGroup Discovery]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.001/ T1069.001]
 |
+Permission Groups Discovery, 
 Local Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -935,10 +1040,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Powershell_get_localgroup_discovery_with_script_block_logging|Powershell Get LocalGroup Discovery with Script Block Logging]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.001/ T1069.001]
 |
+Permission Groups Discovery, 
 Local Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -1034,10 +1142,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Wmic_group_discovery|Wmic Group Discovery]]
 
 |
+[https://attack.mitre.org/techniques/T1069/ T1069], 
 [https://attack.mitre.org/techniques/T1069.001/ T1069.001]
 |
+Permission Groups Discovery, 
 Local Groups
 |
+Discovery, 
 Discovery
 
 | Hunting
@@ -1105,10 +1216,13 @@ Monitor for activities and techniques associated with Password Spraying attacks
 | [[Documentation:ESSOC:detections:Detections#Multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos|Multiple Disabled Users Failing To Authenticate From Host Using Kerberos]]
 
 |
-[https://attack.mitre.org/techniques/T1110.003/ T1110.003]
+[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
+[https://attack.mitre.org/techniques/T1110/ T1110]
 |
-Password Spraying
+Password Spraying, 
+Brute Force
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -1116,10 +1230,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos|Multiple Invalid Users Failing To Authenticate From Host Using Kerberos]]
 
 |
-[https://attack.mitre.org/techniques/T1110.003/ T1110.003]
+[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
+[https://attack.mitre.org/techniques/T1110/ T1110]
 |
-Password Spraying
+Password Spraying, 
+Brute Force
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -1127,10 +1244,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm|Multiple Invalid Users Failing To Authenticate From Host Using NTLM]]
 
 |
-[https://attack.mitre.org/techniques/T1110.003/ T1110.003]
+[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
+[https://attack.mitre.org/techniques/T1110/ T1110]
 |
-Password Spraying
+Password Spraying, 
+Brute Force
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -1138,10 +1258,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Multiple_users_attempting_to_authenticate_using_explicit_credentials|Multiple Users Attempting To Authenticate Using Explicit Credentials]]
 
 |
-[https://attack.mitre.org/techniques/T1110.003/ T1110.003]
+[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
+[https://attack.mitre.org/techniques/T1110/ T1110]
 |
-Password Spraying
+Password Spraying, 
+Brute Force
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -1149,10 +1272,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_host_using_kerberos|Multiple Users Failing To Authenticate From Host Using Kerberos]]
 
 |
-[https://attack.mitre.org/techniques/T1110.003/ T1110.003]
+[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
+[https://attack.mitre.org/techniques/T1110/ T1110]
 |
-Password Spraying
+Password Spraying, 
+Brute Force
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -1160,10 +1286,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_host_using_ntlm|Multiple Users Failing To Authenticate From Host Using NTLM]]
 
 |
-[https://attack.mitre.org/techniques/T1110.003/ T1110.003]
+[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
+[https://attack.mitre.org/techniques/T1110/ T1110]
 |
-Password Spraying
+Password Spraying, 
+Brute Force
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -1171,10 +1300,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_process|Multiple Users Failing To Authenticate From Process]]
 
 |
-[https://attack.mitre.org/techniques/T1110.003/ T1110.003]
+[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
+[https://attack.mitre.org/techniques/T1110/ T1110]
 |
-Password Spraying
+Password Spraying, 
+Brute Force
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -1182,10 +1314,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Multiple_users_remotely_failing_to_authenticate_from_host|Multiple Users Remotely Failing To Authenticate From Host]]
 
 |
-[https://attack.mitre.org/techniques/T1110.003/ T1110.003]
+[https://attack.mitre.org/techniques/T1110.003/ T1110.003], 
+[https://attack.mitre.org/techniques/T1110/ T1110]
 |
-Password Spraying
+Password Spraying, 
+Brute Force
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -1376,10 +1511,13 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 | [[Documentation:ESSOC:detections:Detections#Anomalous_usage_of_7zip|Anomalous usage of 7zip]]
 
 |
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001]
+[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
+[https://attack.mitre.org/techniques/T1560/ T1560]
 |
-Archive via Utility
+Archive via Utility, 
+Archive Collected Data
 |
+Collection, 
 Collection
 
 | Anomaly
@@ -1387,13 +1525,19 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Cmd_echo_pipe_-_escalation|CMD Echo Pipe - Escalation]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
+[https://attack.mitre.org/techniques/T1543/ T1543]
 |
+Command and Scripting Interpreter, 
 Windows Command Shell, 
-Windows Service
+Windows Service, 
+Create or Modify System Process
 |
 Execution, 
+Execution, 
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -1423,10 +1567,13 @@ Defense Evasion, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Detect_regsvr32_application_control_bypass|Detect Regsvr32 Application Control Bypass]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.010/ T1218.010]
 |
+Signed Binary Proxy Execution, 
 Regsvr32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -1445,10 +1592,13 @@ Defense Evasion, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Rundll32_with_no_command_line_arguments_with_network|Rundll32 with no Command Line Arguments with Network]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -1500,13 +1650,19 @@ Defense Evasion, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_rename|Suspicious MSBuild Rename]]
 
 |
-[https://attack.mitre.org/techniques/T1127.001/ T1127.001], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
+[https://attack.mitre.org/techniques/T1036/ T1036], 
+[https://attack.mitre.org/techniques/T1127/ T1127], 
+[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
+[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
 |
-MSBuild, 
-Rename System Utilities
+Masquerading, 
+Trusted Developer Utilities Proxy Execution, 
+Rename System Utilities, 
+MSBuild
 |
 Defense Evasion, 
+Defense Evasion, 
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -1514,10 +1670,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_startw|Suspicious Rundll32 StartW]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -1525,10 +1684,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_no_command_line_arguments|Suspicious Rundll32 no Command Line Arguments]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -1547,13 +1709,16 @@ Defense Evasion, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Suspicious_microsoft_workflow_compiler_rename|Suspicious microsoft workflow compiler rename]]
 
 |
+[https://attack.mitre.org/techniques/T1036/ T1036], 
 [https://attack.mitre.org/techniques/T1127/ T1127], 
 [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
+Masquerading, 
 Trusted Developer Utilities Proxy Execution, 
 Rename System Utilities
 |
 Defense Evasion, 
+Defense Evasion, 
 Defense Evasion
 
 | Hunting
@@ -1561,13 +1726,19 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_path|Suspicious msbuild path]]
 
 |
-[https://attack.mitre.org/techniques/T1127.001/ T1127.001], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
+[https://attack.mitre.org/techniques/T1036/ T1036], 
+[https://attack.mitre.org/techniques/T1127/ T1127], 
+[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
+[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
 |
-MSBuild, 
-Rename System Utilities
+Masquerading, 
+Trusted Developer Utilities Proxy Execution, 
+Rename System Utilities, 
+MSBuild
 |
 Defense Evasion, 
+Defense Evasion, 
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -1629,10 +1800,13 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 | [[Documentation:ESSOC:detections:Detections#Detect_renamed_7-zip|Detect Renamed 7-Zip]]
 
 |
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001]
+[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
+[https://attack.mitre.org/techniques/T1560/ T1560]
 |
-Archive via Utility
+Archive via Utility, 
+Archive Collected Data
 |
+Collection, 
 Collection
 
 | Hunting
@@ -1640,10 +1814,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Detect_renamed_winrar|Detect Renamed WinRAR]]
 
 |
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001]
+[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
+[https://attack.mitre.org/techniques/T1560/ T1560]
 |
-Archive via Utility
+Archive via Utility, 
+Archive Collected Data
 |
+Collection, 
 Collection
 
 | Hunting
@@ -1651,10 +1828,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Email_files_written_outside_of_the_outlook_directory|Email files written outside of the Outlook directory]]
 
 |
+[https://attack.mitre.org/techniques/T1114/ T1114], 
 [https://attack.mitre.org/techniques/T1114.001/ T1114.001]
 |
+Email Collection, 
 Local Email Collection
 |
+Collection, 
 Collection
 
 | TTP
@@ -1662,10 +1842,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Email_servers_sending_high_volume_traffic_to_hosts|Email servers sending high volume traffic to hosts]]
 
 |
+[https://attack.mitre.org/techniques/T1114/ T1114], 
 [https://attack.mitre.org/techniques/T1114.002/ T1114.002]
 |
+Email Collection, 
 Remote Email Collection
 |
+Collection, 
 Collection
 
 | Anomaly
@@ -1673,10 +1856,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Hosts_receiving_high_volume_of_network_traffic_from_email_server|Hosts receiving high volume of network traffic from email server]]
 
 |
-[https://attack.mitre.org/techniques/T1114.002/ T1114.002]
+[https://attack.mitre.org/techniques/T1114.002/ T1114.002], 
+[https://attack.mitre.org/techniques/T1114/ T1114]
 |
-Remote Email Collection
+Remote Email Collection, 
+Email Collection
 |
+Collection, 
 Collection
 
 | Anomaly
@@ -1748,10 +1934,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]
 
 |
-[https://attack.mitre.org/techniques/T1071.004/ T1071.004]
+[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
+[https://attack.mitre.org/techniques/T1071/ T1071]
 |
-DNS
+DNS, 
+Application Layer Protocol
 |
+Command And Control, 
 Command And Control
 
 | Anomaly
@@ -1759,10 +1948,13 @@ Command And Control
 | [[Documentation:ESSOC:detections:Detections#Dns_query_length_with_high_standard_deviation|DNS Query Length With High Standard Deviation]]
 
 |
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003]
+[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
+Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
+Exfiltration Over Alternative Protocol
 |
+Exfiltration, 
 Exfiltration
 
 | Anomaly
@@ -1800,10 +1992,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Excessive_dns_failures|Excessive DNS Failures]]
 
 |
-[https://attack.mitre.org/techniques/T1071.004/ T1071.004]
+[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
+[https://attack.mitre.org/techniques/T1071/ T1071]
 |
-DNS
+DNS, 
+Application Layer Protocol
 |
+Command And Control, 
 Command And Control
 
 | Anomaly
@@ -1822,10 +2017,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Multiple_archive_files_http_post_traffic|Multiple Archive Files Http Post Traffic]]
 
 |
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003]
+[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
+Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
+Exfiltration Over Alternative Protocol
 |
+Exfiltration, 
 Exfiltration
 
 | TTP
@@ -1833,10 +2031,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Plain_http_post_exfiltrated_data|Plain HTTP POST Exfiltrated Data]]
 
 |
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003]
+[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
+Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
+Exfiltration Over Alternative Protocol
 |
+Exfiltration, 
 Exfiltration
 
 | TTP
@@ -1855,10 +2056,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Protocol_or_port_mismatch|Protocol or Port Mismatch]]
 
 |
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003]
+[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
+Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
+Exfiltration Over Alternative Protocol
 |
+Exfiltration, 
 Exfiltration
 
 | Anomaly
@@ -1866,10 +2070,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]
 
 |
+[https://attack.mitre.org/techniques/T1071/ T1071], 
 [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
 |
+Application Layer Protocol, 
 Web Protocols
 |
+Command And Control, 
 Command And Control
 
 | TTP
@@ -1923,10 +2130,13 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 | [[Documentation:ESSOC:detections:Detections#Access_lsass_memory_for_dump_creation|Access LSASS Memory for Dump Creation]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2053,10 +2263,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Attempted_credential_dump_from_registry_via_reg_exe|Attempted Credential Dump From Registry via Reg exe]]
 
 |
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002]
+[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-Security Account Manager
+Security Account Manager, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2064,10 +2277,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Create_remote_thread_into_lsass|Create Remote Thread into LSASS]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2075,10 +2291,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Creation_of_shadow_copy|Creation of Shadow Copy]]
 
 |
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003]
+[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-NTDS
+NTDS, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2086,10 +2305,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Creation_of_shadow_copy_with_wmic_and_powershell|Creation of Shadow Copy with wmic and powershell]]
 
 |
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003]
+[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-NTDS
+NTDS, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2097,10 +2319,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Creation_of_lsass_dump_with_taskmgr|Creation of lsass Dump with Taskmgr]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2108,10 +2333,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Credential_dumping_via_copy_command_from_shadow_copy|Credential Dumping via Copy Command from Shadow Copy]]
 
 |
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003]
+[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-NTDS
+NTDS, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2119,10 +2347,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Credential_dumping_via_symlink_to_shadow_copy|Credential Dumping via Symlink to Shadow Copy]]
 
 |
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003]
+[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-NTDS
+NTDS, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2243,10 +2474,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Detect_copy_of_shadowcopy_with_script_block_logging|Detect Copy of ShadowCopy with Script Block Logging]]
 
 |
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002]
+[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-Security Account Manager
+Security Account Manager, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2254,10 +2488,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Detect_credential_dumping_through_lsass_access|Detect Credential Dumping through LSASS access]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2265,10 +2502,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Detect_dump_lsass_memory_using_comsvcs|Detect Dump LSASS Memory using comsvcs]]
 
 |
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003]
+[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-NTDS
+NTDS, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2276,10 +2516,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Detect_kerberoasting|Detect Kerberoasting]]
 
 |
-[https://attack.mitre.org/techniques/T1558.003/ T1558.003]
+[https://attack.mitre.org/techniques/T1558.003/ T1558.003], 
+[https://attack.mitre.org/techniques/T1558/ T1558]
 |
-Kerberoasting
+Kerberoasting, 
+Steal or Forge Kerberos Tickets
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2287,10 +2530,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2298,10 +2544,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_comsvcs_dll|Dump LSASS via comsvcs DLL]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2309,10 +2558,27 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump|Dump LSASS via procdump]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
+Credential Access
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Enable_wdigest_uselogoncredential_registry|Enable WDigest UseLogonCredential Registry]]
+
+|
+[https://attack.mitre.org/techniques/T1112/ T1112], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
+|
+Modify Registry, 
+OS Credential Dumping
+|
+Defense Evasion, 
 Credential Access
 
 | TTP
@@ -2320,10 +2586,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Esentutl_sam_copy|Esentutl SAM Copy]]
 
 |
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002]
+[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-Security Account Manager
+Security Account Manager, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | Hunting
@@ -2331,10 +2600,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Extraction_of_registry_hives|Extraction of Registry Hives]]
 
 |
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002]
+[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-Security Account Manager
+Security Account Manager, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2342,10 +2614,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Ntdsutil_export_ntds|Ntdsutil Export NTDS]]
 
 |
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003]
+[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-NTDS
+NTDS, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2353,10 +2628,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Sam_database_file_access_attempt|SAM Database File Access Attempt]]
 
 |
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002]
+[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-Security Account Manager
+Security Account Manager, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | Hunting
@@ -2364,10 +2642,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Secretdumps_offline_ntds_dumping_tool|SecretDumps Offline NTDS Dumping Tool]]
 
 |
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003]
+[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-NTDS
+NTDS, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2375,10 +2656,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -2531,10 +2815,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Mailsniper_invoke_functions|Mailsniper Invoke functions]]
 
 |
+[https://attack.mitre.org/techniques/T1114/ T1114], 
 [https://attack.mitre.org/techniques/T1114.001/ T1114.001]
 |
+Email Collection, 
 Local Email Collection
 |
+Collection, 
 Collection
 
 | TTP
@@ -2542,10 +2829,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Multiple_archive_files_http_post_traffic|Multiple Archive Files Http Post Traffic]]
 
 |
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003]
+[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
+Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
+Exfiltration Over Alternative Protocol
 |
+Exfiltration, 
 Exfiltration
 
 | TTP
@@ -2564,10 +2854,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#O365_suspicious_admin_email_forwarding|O365 Suspicious Admin Email Forwarding]]
 
 |
-[https://attack.mitre.org/techniques/T1114.003/ T1114.003]
+[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
+[https://attack.mitre.org/techniques/T1114/ T1114]
 |
-Email Forwarding Rule
+Email Forwarding Rule, 
+Email Collection
 |
+Collection, 
 Collection
 
 | Anomaly
@@ -2575,10 +2868,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#O365_suspicious_user_email_forwarding|O365 Suspicious User Email Forwarding]]
 
 |
-[https://attack.mitre.org/techniques/T1114.003/ T1114.003]
+[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
+[https://attack.mitre.org/techniques/T1114/ T1114]
 |
-Email Forwarding Rule
+Email Forwarding Rule, 
+Email Collection
 |
+Collection, 
 Collection
 
 | Anomaly
@@ -2586,10 +2882,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Plain_http_post_exfiltrated_data|Plain HTTP POST Exfiltrated Data]]
 
 |
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003]
+[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
+Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
+Exfiltration Over Alternative Protocol
 |
+Exfiltration, 
 Exfiltration
 
 | TTP
@@ -2697,10 +2996,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Detect_credential_dumping_through_lsass_access|Detect Credential Dumping through LSASS access]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2708,10 +3010,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -2774,10 +3079,13 @@ Looks for activities and techniques associated with the disabling of security to
 | [[Documentation:ESSOC:detections:Detections#Attempt_to_add_certificate_to_untrusted_store|Attempt To Add Certificate To Untrusted Store]]
 
 |
-[https://attack.mitre.org/techniques/T1553.004/ T1553.004]
+[https://attack.mitre.org/techniques/T1553.004/ T1553.004], 
+[https://attack.mitre.org/techniques/T1553/ T1553]
 |
-Install Root Certificate
+Install Root Certificate, 
+Subvert Trust Controls
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -2785,10 +3093,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Attempt_to_stop_security_service|Attempt To Stop Security Service]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -2796,10 +3107,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]
 
 |
-[https://attack.mitre.org/techniques/T1562.004/ T1562.004]
+[https://attack.mitre.org/techniques/T1562.004/ T1562.004], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify System Firewall
+Disable or Modify System Firewall, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -2807,10 +3121,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
 
 |
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
+[https://attack.mitre.org/techniques/T1543/ T1543]
 |
-Windows Service
+Windows Service, 
+Create or Modify System Process
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -2829,10 +3146,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Unload_sysmon_filter_driver|Unload Sysmon Filter Driver]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -3002,10 +3322,13 @@ HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVE
 | [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3013,10 +3336,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Detect_exchange_web_shell|Detect Exchange Web Shell]]
 
 |
+[https://attack.mitre.org/techniques/T1505/ T1505], 
 [https://attack.mitre.org/techniques/T1505.003/ T1505.003]
 |
+Server Software Component, 
 Web Shell
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -3024,10 +3350,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#Detect_new_local_admin_account|Detect New Local Admin account]]
 
 |
-[https://attack.mitre.org/techniques/T1136.001/ T1136.001]
+[https://attack.mitre.org/techniques/T1136.001/ T1136.001], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Local Account
+Local Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -3035,10 +3364,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
 
 |
+[https://attack.mitre.org/techniques/T1021/ T1021], 
 [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
 |
+Remote Services, 
 SMB/Windows Admin Shares
 |
+Lateral Movement, 
 Lateral Movement
 
 | TTP
@@ -3046,10 +3378,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
 
 |
+[https://attack.mitre.org/techniques/T1569/ T1569], 
 [https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
+System Services, 
 Service Execution
 |
+Execution, 
 Execution
 
 | Hunting
@@ -3057,10 +3392,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_comsvcs_dll|Dump LSASS via comsvcs DLL]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -3068,10 +3406,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump|Dump LSASS via procdump]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -3079,10 +3420,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Email_servers_sending_high_volume_traffic_to_hosts|Email servers sending high volume traffic to hosts]]
 
 |
+[https://attack.mitre.org/techniques/T1114/ T1114], 
 [https://attack.mitre.org/techniques/T1114.002/ T1114.002]
 |
+Email Collection, 
 Remote Email Collection
 |
+Collection, 
 Collection
 
 | Anomaly
@@ -3090,10 +3434,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]
 
 |
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
+[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
+[https://attack.mitre.org/techniques/T1059/ T1059]
 |
-PowerShell
+PowerShell, 
+Command and Scripting Interpreter
 |
+Execution, 
 Execution
 
 | Hunting
@@ -3101,10 +3448,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_execution_policy_bypass|Malicious PowerShell Process - Execution Policy Bypass]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3112,10 +3462,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Nishang_powershelltcponeline|Nishang PowershellTCPOneLine]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3123,10 +3476,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Ntdsutil_export_ntds|Ntdsutil Export NTDS]]
 
 |
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003]
+[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-NTDS
+NTDS, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -3134,10 +3490,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3156,10 +3515,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#W3wp_spawning_shell|W3WP Spawning Shell]]
 
 |
+[https://attack.mitre.org/techniques/T1505/ T1505], 
 [https://attack.mitre.org/techniques/T1505.003/ T1505.003]
 |
+Server Software Component, 
 Web Shell
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -3219,10 +3581,13 @@ Adversaries may transfer tools or other files from an external system into a com
 | [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadfile|Any Powershell DownloadFile]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3230,10 +3595,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3326,10 +3694,13 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 | [[Documentation:ESSOC:detections:Detections#Detect_activity_related_to_pass_the_hash_attacks|Detect Activity Related to Pass the Hash Attacks]]
 
 |
+[https://attack.mitre.org/techniques/T1550/ T1550], 
 [https://attack.mitre.org/techniques/T1550.002/ T1550.002]
 |
+Use Alternate Authentication Material, 
 Pass the Hash
 |
+Defense Evasion, Lateral Movement, 
 Defense Evasion, Lateral Movement
 
 | TTP
@@ -3337,10 +3708,13 @@ Defense Evasion, Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Detect_pass_the_hash|Detect Pass the Hash]]
 
 |
+[https://attack.mitre.org/techniques/T1550/ T1550], 
 [https://attack.mitre.org/techniques/T1550.002/ T1550.002]
 |
+Use Alternate Authentication Material, 
 Pass the Hash
 |
+Defense Evasion, Lateral Movement, 
 Defense Evasion, Lateral Movement
 
 | TTP
@@ -3348,10 +3722,13 @@ Defense Evasion, Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
 
 |
+[https://attack.mitre.org/techniques/T1021/ T1021], 
 [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
 |
+Remote Services, 
 SMB/Windows Admin Shares
 |
+Lateral Movement, 
 Lateral Movement
 
 | TTP
@@ -3359,10 +3736,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
 
 |
+[https://attack.mitre.org/techniques/T1569/ T1569], 
 [https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
+System Services, 
 Service Execution
 |
+Execution, 
 Execution
 
 | Hunting
@@ -3370,10 +3750,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Kerberoasting_spn_request_with_rc4_encryption|Kerberoasting spn request with RC4 encryption]]
 
 |
-[https://attack.mitre.org/techniques/T1558.003/ T1558.003]
+[https://attack.mitre.org/techniques/T1558.003/ T1558.003], 
+[https://attack.mitre.org/techniques/T1558/ T1558]
 |
-Kerberoasting
+Kerberoasting, 
+Steal or Forge Kerberos Tickets
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -3381,10 +3764,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Potential_pass_the_token_or_hash_observed_at_the_destination_device|Potential Pass the Token or Hash Observed at the Destination Device]]
 
 |
+[https://attack.mitre.org/techniques/T1550/ T1550], 
 [https://attack.mitre.org/techniques/T1550.002/ T1550.002]
 |
+Use Alternate Authentication Material, 
 Pass the Hash
 |
+Defense Evasion, Lateral Movement, 
 Defense Evasion, Lateral Movement
 
 | TTP
@@ -3392,10 +3778,13 @@ Defense Evasion, Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Potential_pass_the_token_or_hash_observed_by_an_event_collecting_device|Potential Pass the Token or Hash Observed by an Event Collecting Device]]
 
 |
+[https://attack.mitre.org/techniques/T1550/ T1550], 
 [https://attack.mitre.org/techniques/T1550.002/ T1550.002]
 |
+Use Alternate Authentication Material, 
 Pass the Hash
 |
+Defense Evasion, Lateral Movement, 
 Defense Evasion, Lateral Movement
 
 | TTP
@@ -3403,10 +3792,13 @@ Defense Evasion, Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
 
 |
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001]
+[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-Remote Desktop Protocol
+Remote Desktop Protocol, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -3414,10 +3806,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Remote_desktop_process_running_on_system|Remote Desktop Process Running On System]]
 
 |
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001]
+[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-Remote Desktop Protocol
+Remote Desktop Protocol, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Hunting
@@ -3425,10 +3820,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Schtasks_scheduling_job_on_remote_system|Schtasks scheduling job on remote system]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -3478,10 +3876,13 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
 | [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadfile|Any Powershell DownloadFile]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3489,10 +3890,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3544,10 +3948,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Detect_empire_with_powershell_script_block_logging|Detect Empire with PowerShell Script Block Logging]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3620,10 +4027,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]
 
 |
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
+[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
+[https://attack.mitre.org/techniques/T1059/ T1059]
 |
-PowerShell
+PowerShell, 
+Command and Scripting Interpreter
 |
+Execution, 
 Execution
 
 | Hunting
@@ -3642,10 +4052,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_with_obfuscation_techniques|Malicious PowerShell Process With Obfuscation Techniques]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3653,10 +4066,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Powershell_4104_hunting|PowerShell 4104 Hunting]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | Hunting
@@ -3664,10 +4080,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Powershell_domain_enumeration|PowerShell Domain Enumeration]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3675,10 +4094,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Powershell_loading_dotnet_into_memory_via_system_reflection_assembly|PowerShell Loading DotNET into Memory via System Reflection Assembly]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3686,10 +4108,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Powershell_creating_thread_mutex|Powershell Creating Thread Mutex]]
 
 |
+[https://attack.mitre.org/techniques/T1027/ T1027], 
 [https://attack.mitre.org/techniques/T1027.005/ T1027.005]
 |
+Obfuscated Files or Information, 
 Indicator Removal from Tools
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -3697,10 +4122,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Powershell_enable_smb1protocol_feature|Powershell Enable SMB1Protocol Feature]]
 
 |
+[https://attack.mitre.org/techniques/T1027/ T1027], 
 [https://attack.mitre.org/techniques/T1027.005/ T1027.005]
 |
+Obfuscated Files or Information, 
 Indicator Removal from Tools
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -3708,10 +4136,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Powershell_execute_com_object|Powershell Execute COM Object]]
 
 |
-[https://attack.mitre.org/techniques/T1546.015/ T1546.015]
+[https://attack.mitre.org/techniques/T1546.015/ T1546.015], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
 |
-Component Object Model Hijacking
+Component Object Model Hijacking, 
+Event Triggered Execution
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
 | TTP
@@ -3719,12 +4150,15 @@ Privilege Escalation, Persistence
 | [[Documentation:ESSOC:detections:Detections#Powershell_fileless_process_injection_via_getprocaddress|Powershell Fileless Process Injection via GetProcAddress]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1055/ T1055], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 Process Injection, 
 PowerShell
 |
+Execution, 
 Defense Evasion, Privilege Escalation, 
 Execution
 
@@ -3733,12 +4167,15 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Powershell_fileless_script_contains_base64_encoded_content|Powershell Fileless Script Contains Base64 Encoded Content]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1027/ T1027], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 Obfuscated Files or Information, 
 PowerShell
 |
+Execution, 
 Defense Evasion, 
 Execution
 
@@ -3747,10 +4184,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Powershell_processing_stream_of_data|Powershell Processing Stream Of Data]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3791,10 +4231,13 @@ Reconnaissance
 | [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -3872,10 +4315,30 @@ Adversaries may rename legitimate system utilities to try to evade security mech
 | [[Documentation:ESSOC:detections:Detections#Execution_of_file_with_multiple_extensions|Execution of File with Multiple Extensions]]
 
 |
+[https://attack.mitre.org/techniques/T1036/ T1036], 
 [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
+Masquerading, 
 Rename System Utilities
 |
+Defense Evasion, 
+Defense Evasion
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Sdelete_application_execution|Sdelete Application Execution]]
+
+|
+[https://attack.mitre.org/techniques/T1485/ T1485], 
+[https://attack.mitre.org/techniques/T1070.004/ T1070.004], 
+[https://attack.mitre.org/techniques/T1070/ T1070]
+|
+Data Destruction, 
+File Deletion, 
+Indicator Removal on Host
+|
+Impact, 
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -3883,13 +4346,19 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_rename|Suspicious MSBuild Rename]]
 
 |
-[https://attack.mitre.org/techniques/T1127.001/ T1127.001], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
+[https://attack.mitre.org/techniques/T1036/ T1036], 
+[https://attack.mitre.org/techniques/T1127/ T1127], 
+[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
+[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
 |
-MSBuild, 
-Rename System Utilities
+Masquerading, 
+Trusted Developer Utilities Proxy Execution, 
+Rename System Utilities, 
+MSBuild
 |
 Defense Evasion, 
+Defense Evasion, 
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -3897,13 +4366,19 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_rename|Suspicious Rundll32 Rename]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
+[https://attack.mitre.org/techniques/T1036/ T1036], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
 [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
+Signed Binary Proxy Execution, 
+Masquerading, 
 Rundll32, 
 Rename System Utilities
 |
 Defense Evasion, 
+Defense Evasion, 
+Defense Evasion, 
 Defense Evasion
 
 | Hunting
@@ -3911,13 +4386,16 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_microsoft_workflow_compiler_rename|Suspicious microsoft workflow compiler rename]]
 
 |
+[https://attack.mitre.org/techniques/T1036/ T1036], 
 [https://attack.mitre.org/techniques/T1127/ T1127], 
 [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
+Masquerading, 
 Trusted Developer Utilities Proxy Execution, 
 Rename System Utilities
 |
 Defense Evasion, 
+Defense Evasion, 
 Defense Evasion
 
 | Hunting
@@ -3925,13 +4403,19 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_path|Suspicious msbuild path]]
 
 |
-[https://attack.mitre.org/techniques/T1127.001/ T1127.001], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
+[https://attack.mitre.org/techniques/T1036/ T1036], 
+[https://attack.mitre.org/techniques/T1127/ T1127], 
+[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
+[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
 |
-MSBuild, 
-Rename System Utilities
+Masquerading, 
+Trusted Developer Utilities Proxy Execution, 
+Rename System Utilities, 
+MSBuild
 |
 Defense Evasion, 
+Defense Evasion, 
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -3950,10 +4434,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]
 
 |
+[https://attack.mitre.org/techniques/T1036/ T1036], 
 [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
+Masquerading, 
 Rename System Utilities
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -4061,10 +4548,13 @@ CVE-2021-40444 is a remote code execution vulnerability in MSHTML, recently used
 | [[Documentation:ESSOC:detections:Detections#Control_loading_from_world_writable_directory|Control Loading from World Writable Directory]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.002/ T1218.002]
 |
+Signed Binary Proxy Execution, 
 Control Panel
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -4072,10 +4562,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Mshtml_module_load_in_office_product|MSHTML Module Load in Office Product]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4083,10 +4576,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_product_writing_cab_or_inf|Office Product Writing cab or inf]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4094,10 +4590,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_spawning_control|Office Spawning Control]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4105,10 +4604,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Rundll32_control_rundll_hunt|Rundll32 Control RunDLL Hunt]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | Hunting
@@ -4116,10 +4618,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Rundll32_control_rundll_world_writable_directory|Rundll32 Control RunDLL World Writable Directory]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -4167,10 +4672,13 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 | [[Documentation:ESSOC:detections:Detections#Anomalous_usage_of_7zip|Anomalous usage of 7zip]]
 
 |
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001]
+[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
+[https://attack.mitre.org/techniques/T1560/ T1560]
 |
-Archive via Utility
+Archive via Utility, 
+Archive Collected Data
 |
+Collection, 
 Collection
 
 | Anomaly
@@ -4178,10 +4686,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Detect_outbound_smb_traffic|Detect Outbound SMB Traffic]]
 
 |
-[https://attack.mitre.org/techniques/T1071.002/ T1071.002]
+[https://attack.mitre.org/techniques/T1071.002/ T1071.002], 
+[https://attack.mitre.org/techniques/T1071/ T1071]
 |
-File Transfer Protocols
+File Transfer Protocols, 
+Application Layer Protocol
 |
+Command And Control, 
 Command And Control
 
 | TTP
@@ -4189,10 +4700,13 @@ Command And Control
 | [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
+Command and Scripting Interpreter, 
 Windows Command Shell
 |
+Execution, 
 Execution
 
 | Hunting
@@ -4200,10 +4714,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Detect_rundll32_inline_hta_execution|Detect Rundll32 Inline HTA Execution]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.005/ T1218.005]
 |
+Signed Binary Proxy Execution, 
 Mshta
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -4211,10 +4728,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]
 
 |
+[https://attack.mitre.org/techniques/T1569/ T1569], 
 [https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
+System Services, 
 Service Execution
 |
+Execution, 
 Execution
 
 | Anomaly
@@ -4233,10 +4753,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
 
 |
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
+[https://attack.mitre.org/techniques/T1543/ T1543]
 |
-Windows Service
+Windows Service, 
+Create or Modify System Process
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -4244,10 +4767,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Scheduled_task_deleted_or_created_via_cmd|Scheduled Task Deleted Or Created via CMD]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -4255,10 +4781,13 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Schtasks_scheduling_job_on_remote_system|Schtasks scheduling job on remote system]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -4288,10 +4817,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]
 
 |
+[https://attack.mitre.org/techniques/T1071/ T1071], 
 [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
 |
+Application Layer Protocol, 
 Web Protocols
 |
+Command And Control, 
 Command And Control
 
 | TTP
@@ -4432,10 +4964,13 @@ Monitor your environment for suspicious behaviors that resemble the techniques e
 | [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]
 
 |
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
+[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
+[https://attack.mitre.org/techniques/T1059/ T1059]
 |
-PowerShell
+PowerShell, 
+Command and Scripting Interpreter
 |
+Execution, 
 Execution
 
 | Hunting
@@ -4443,10 +4978,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Registry Run Keys / Startup Folder
+Registry Run Keys / Startup Folder, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -4510,10 +5048,13 @@ ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server
 | [[Documentation:ESSOC:detections:Detections#Detect_exchange_web_shell|Detect Exchange Web Shell]]
 
 |
+[https://attack.mitre.org/techniques/T1505/ T1505], 
 [https://attack.mitre.org/techniques/T1505.003/ T1505.003]
 |
+Server Software Component, 
 Web Shell
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -4532,10 +5073,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Exchange_powershell_module_usage|Exchange PowerShell Module Usage]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -4543,10 +5087,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#W3wp_spawning_shell|W3WP Spawning Shell]]
 
 |
+[https://attack.mitre.org/techniques/T1505/ T1505], 
 [https://attack.mitre.org/techniques/T1505.003/ T1505.003]
 |
+Server Software Component, 
 Web Shell
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -4660,10 +5207,13 @@ Command And Control
 | [[Documentation:ESSOC:detections:Detections#Suspicious_plistbuddy_usage|Suspicious PlistBuddy Usage]]
 
 |
-[https://attack.mitre.org/techniques/T1543.001/ T1543.001]
+[https://attack.mitre.org/techniques/T1543.001/ T1543.001], 
+[https://attack.mitre.org/techniques/T1543/ T1543]
 |
-Launch Agent
+Launch Agent, 
+Create or Modify System Process
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -4671,10 +5221,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Suspicious_plistbuddy_usage_via_osquery|Suspicious PlistBuddy Usage via OSquery]]
 
 |
-[https://attack.mitre.org/techniques/T1543.001/ T1543.001]
+[https://attack.mitre.org/techniques/T1543.001/ T1543.001], 
+[https://attack.mitre.org/techniques/T1543/ T1543]
 |
-Launch Agent
+Launch Agent, 
+Create or Modify System Process
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -4731,10 +5284,13 @@ Detect signs of malicious payloads that may indicate that your environment has b
 | [[Documentation:ESSOC:detections:Detections#Detect_outlook_exe_writing_a_zip_file|Detect Outlook exe writing a zip file]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4742,10 +5298,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Excel_spawning_powershell|Excel Spawning PowerShell]]
 
 |
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002]
+[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-Security Account Manager
+Security Account Manager, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -4753,10 +5312,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Excel_spawning_windows_script_host|Excel Spawning Windows Script Host]]
 
 |
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002]
+[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-Security Account Manager
+Security Account Manager, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -4764,10 +5326,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Mshtml_module_load_in_office_product|MSHTML Module Load in Office Product]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4775,10 +5340,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4786,10 +5354,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_document_creating_schedule_task|Office Document Creating Schedule Task]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4797,10 +5368,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4808,10 +5382,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_document_spawned_child_process_to_download|Office Document Spawned Child Process To Download]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4819,10 +5396,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_product_spawning_bitsadmin|Office Product Spawning BITSAdmin]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4830,10 +5410,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_product_spawning_certutil|Office Product Spawning CertUtil]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4841,10 +5424,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_product_spawning_mshta|Office Product Spawning MSHTA]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4852,10 +5438,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_product_spawning_rundll32_with_no_dll|Office Product Spawning Rundll32 with no DLL]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4863,10 +5452,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_product_spawning_wmic|Office Product Spawning Wmic]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4874,10 +5466,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_product_writing_cab_or_inf|Office Product Writing cab or inf]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4885,10 +5480,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_spawning_control|Office Spawning Control]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4896,10 +5494,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Process_creating_lnk_file_in_suspicious_location|Process Creating LNK file in Suspicious Location]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.002/ T1566.002]
 |
+Phishing, 
 Spearphishing Link
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4907,10 +5508,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Winword_spawning_cmd|Winword Spawning Cmd]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4918,10 +5522,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Winword_spawning_powershell|Winword Spawning PowerShell]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -4969,10 +5576,13 @@ Leveraging the Windows command-line interface (CLI) is one of the most common at
 | [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
+Command and Scripting Interpreter, 
 Windows Command Shell
 |
+Execution, 
 Execution
 
 | Hunting
@@ -4991,10 +5601,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Detect_use_of_cmd_exe_to_launch_script_interpreters|Detect Use of cmd exe to Launch Script Interpreters]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
+Command and Scripting Interpreter, 
 Windows Command Shell
 |
+Execution, 
 Execution
 
 | TTP
@@ -5002,10 +5615,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]
 
 |
+[https://attack.mitre.org/techniques/T1036/ T1036], 
 [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
+Masquerading, 
 Rename System Utilities
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5071,10 +5687,13 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce
 | [[Documentation:ESSOC:detections:Detections#Detect_html_help_renamed|Detect HTML Help Renamed]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.001/ T1218.001]
 |
+Signed Binary Proxy Execution, 
 Compiled HTML File
 |
+Defense Evasion, 
 Defense Evasion
 
 | Hunting
@@ -5082,10 +5701,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_html_help_spawn_child_process|Detect HTML Help Spawn Child Process]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.001/ T1218.001]
 |
+Signed Binary Proxy Execution, 
 Compiled HTML File
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5093,10 +5715,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_html_help_url_in_command_line|Detect HTML Help URL in Command Line]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.001/ T1218.001]
 |
+Signed Binary Proxy Execution, 
 Compiled HTML File
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5104,10 +5729,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_html_help_using_infotech_storage_handlers|Detect HTML Help Using InfoTech Storage Handlers]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.001/ T1218.001]
 |
+Signed Binary Proxy Execution, 
 Compiled HTML File
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5166,10 +5794,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]
 
 |
-[https://attack.mitre.org/techniques/T1071.004/ T1071.004]
+[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
+[https://attack.mitre.org/techniques/T1071/ T1071]
 |
-DNS
+DNS, 
+Application Layer Protocol
 |
+Command And Control, 
 Command And Control
 
 | Anomaly
@@ -5177,10 +5808,13 @@ Command And Control
 | [[Documentation:ESSOC:detections:Detections#Dns_query_length_with_high_standard_deviation|DNS Query Length With High Standard Deviation]]
 
 |
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003]
+[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
+Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
+Exfiltration Over Alternative Protocol
 |
+Exfiltration, 
 Exfiltration
 
 | Anomaly
@@ -5199,10 +5833,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Excessive_dns_failures|Excessive DNS Failures]]
 
 |
-[https://attack.mitre.org/techniques/T1071.004/ T1071.004]
+[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
+[https://attack.mitre.org/techniques/T1071/ T1071]
 |
-DNS
+DNS, 
+Application Layer Protocol
 |
+Command And Control, 
 Command And Control
 
 | Anomaly
@@ -5281,10 +5918,13 @@ Email remains one of the primary means for attackers to gain an initial foothold
 | [[Documentation:ESSOC:detections:Detections#Suspicious_email_attachment_extensions|Suspicious Email Attachment Extensions]]
 
 |
-[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
+[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
+[https://attack.mitre.org/techniques/T1566/ T1566]
 |
-Spearphishing Attachment
+Spearphishing Attachment, 
+Phishing
 |
+Initial Access, 
 Initial Access
 
 | Anomaly
@@ -5328,10 +5968,13 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce
 | [[Documentation:ESSOC:detections:Detections#Detect_mshta_url_in_command_line|Detect MSHTA Url in Command Line]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.005/ T1218.005]
 |
+Signed Binary Proxy Execution, 
 Mshta
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5339,10 +5982,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
+Command and Scripting Interpreter, 
 Windows Command Shell
 |
+Execution, 
 Execution
 
 | Hunting
@@ -5361,10 +6007,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Detect_rundll32_inline_hta_execution|Detect Rundll32 Inline HTA Execution]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.005/ T1218.005]
 |
+Signed Binary Proxy Execution, 
 Mshta
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5372,10 +6021,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_mshta_inline_hta_execution|Detect mshta inline hta execution]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.005/ T1218.005]
 |
+Signed Binary Proxy Execution, 
 Mshta
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5383,10 +6035,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_mshta_renamed|Detect mshta renamed]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.005/ T1218.005]
 |
+Signed Binary Proxy Execution, 
 Mshta
 |
+Defense Evasion, 
 Defense Evasion
 
 | Hunting
@@ -5394,10 +6049,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Registry Run Keys / Startup Folder
+Registry Run Keys / Startup Folder, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -5405,10 +6063,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Suspicious_mshta_child_process|Suspicious mshta child process]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.005/ T1218.005]
 |
+Signed Binary Proxy Execution, 
 Mshta
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5416,10 +6077,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_mshta_spawn|Suspicious mshta spawn]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.005/ T1218.005]
 |
+Signed Binary Proxy Execution, 
 Mshta
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5471,10 +6135,13 @@ Monitor your Okta environment for suspicious activities. Due to the Covid outbre
 | [[Documentation:ESSOC:detections:Detections#Multiple_okta_users_with_invalid_credentials_from_the_same_ip|Multiple Okta Users With Invalid Credentials From The Same IP]]
 
 |
+[https://attack.mitre.org/techniques/T1078/ T1078], 
 [https://attack.mitre.org/techniques/T1078.001/ T1078.001]
 |
+Valid Accounts, 
 Default Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | TTP
@@ -5482,10 +6149,13 @@ Defense Evasion, Persistence, Privilege Escalation, Initial Access
 | [[Documentation:ESSOC:detections:Detections#Okta_account_lockout_events|Okta Account Lockout Events]]
 
 |
+[https://attack.mitre.org/techniques/T1078/ T1078], 
 [https://attack.mitre.org/techniques/T1078.001/ T1078.001]
 |
+Valid Accounts, 
 Default Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
@@ -5493,10 +6163,13 @@ Defense Evasion, Persistence, Privilege Escalation, Initial Access
 | [[Documentation:ESSOC:detections:Detections#Okta_failed_sso_attempts|Okta Failed SSO Attempts]]
 
 |
+[https://attack.mitre.org/techniques/T1078/ T1078], 
 [https://attack.mitre.org/techniques/T1078.001/ T1078.001]
 |
+Valid Accounts, 
 Default Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
@@ -5504,10 +6177,13 @@ Defense Evasion, Persistence, Privilege Escalation, Initial Access
 | [[Documentation:ESSOC:detections:Detections#Okta_user_logins_from_multiple_cities|Okta User Logins From Multiple Cities]]
 
 |
+[https://attack.mitre.org/techniques/T1078/ T1078], 
 [https://attack.mitre.org/techniques/T1078.001/ T1078.001]
 |
+Valid Accounts, 
 Default Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
@@ -5553,10 +6229,13 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce
 | [[Documentation:ESSOC:detections:Detections#Detect_regasm_spawning_a_process|Detect Regasm Spawning a Process]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.009/ T1218.009]
 |
+Signed Binary Proxy Execution, 
 Regsvcs/Regasm
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5564,10 +6243,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_regasm_with_network_connection|Detect Regasm with Network Connection]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.009/ T1218.009]
 |
+Signed Binary Proxy Execution, 
 Regsvcs/Regasm
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5575,10 +6257,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_regasm_with_no_command_line_arguments|Detect Regasm with no Command Line Arguments]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.009/ T1218.009]
 |
+Signed Binary Proxy Execution, 
 Regsvcs/Regasm
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5586,10 +6271,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_regsvcs_spawning_a_process|Detect Regsvcs Spawning a Process]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.009/ T1218.009]
 |
+Signed Binary Proxy Execution, 
 Regsvcs/Regasm
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5597,10 +6285,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_regsvcs_with_network_connection|Detect Regsvcs with Network Connection]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.009/ T1218.009]
 |
+Signed Binary Proxy Execution, 
 Regsvcs/Regasm
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5608,10 +6299,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_regsvcs_with_no_command_line_arguments|Detect Regsvcs with No Command Line Arguments]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.009/ T1218.009]
 |
+Signed Binary Proxy Execution, 
 Regsvcs/Regasm
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5659,10 +6353,41 @@ Monitor and detect techniques used by attackers who leverage the regsvr32.exe pr
 | [[Documentation:ESSOC:detections:Detections#Detect_regsvr32_application_control_bypass|Detect Regsvr32 Application Control Bypass]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.010/ T1218.010]
 |
+Signed Binary Proxy Execution, 
 Regsvr32
 |
+Defense Evasion, 
+Defense Evasion
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Malicious_inprocserver32_modification|Malicious InProcServer32 Modification]]
+
+|
+[https://attack.mitre.org/techniques/T1218.010/ T1218.010], 
+[https://attack.mitre.org/techniques/T1112/ T1112]
+|
+Regsvr32, 
+Modify Registry
+|
+Defense Evasion, 
+Defense Evasion
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Regsvr32_silent_param_dll_loading|Regsvr32 Silent Param Dll Loading]]
+
+|
+[https://attack.mitre.org/techniques/T1218/ T1218], 
+[https://attack.mitre.org/techniques/T1218.010/ T1218.010]
+|
+Signed Binary Proxy Execution, 
+Regsvr32
+|
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5670,10 +6395,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_regsvr32_register_suspicious_path|Suspicious Regsvr32 Register Suspicious Path]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.010/ T1218.010]
 |
+Signed Binary Proxy Execution, 
 Regsvr32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5683,6 +6411,8 @@ Defense Evasion
 
 * Actions on Objectives
 
+* Exploitation
+
 
 ====Reference====
 
@@ -5721,10 +6451,13 @@ Monitor and detect techniques used by attackers who leverage rundll32.exe to exe
 | [[Documentation:ESSOC:detections:Detections#Detect_rundll32_application_control_bypass_-_advpack|Detect Rundll32 Application Control Bypass - advpack]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5732,10 +6465,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_rundll32_application_control_bypass_-_setupapi|Detect Rundll32 Application Control Bypass - setupapi]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5743,10 +6479,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Detect_rundll32_application_control_bypass_-_syssetup|Detect Rundll32 Application Control Bypass - syssetup]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5754,10 +6493,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_comsvcs_dll|Dump LSASS via comsvcs DLL]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -5765,10 +6507,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Rundll32_control_rundll_hunt|Rundll32 Control RunDLL Hunt]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | Hunting
@@ -5776,10 +6521,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Rundll32_control_rundll_world_writable_directory|Rundll32 Control RunDLL World Writable Directory]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5787,10 +6535,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Rundll32_with_no_command_line_arguments_with_network|Rundll32 with no Command Line Arguments with Network]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5798,13 +6549,19 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_rename|Suspicious Rundll32 Rename]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
+[https://attack.mitre.org/techniques/T1036/ T1036], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
 [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
+Signed Binary Proxy Execution, 
+Masquerading, 
 Rundll32, 
 Rename System Utilities
 |
 Defense Evasion, 
+Defense Evasion, 
+Defense Evasion, 
 Defense Evasion
 
 | Hunting
@@ -5812,10 +6569,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_startw|Suspicious Rundll32 StartW]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5823,10 +6583,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_dllregisterserver|Suspicious Rundll32 dllregisterserver]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5834,10 +6597,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_no_command_line_arguments|Suspicious Rundll32 no Command Line Arguments]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -5887,10 +6653,13 @@ Attackers are increasingly abusing Windows Management Instrumentation (WMI), a f
 | [[Documentation:ESSOC:detections:Detections#Detect_wmi_event_subscription_persistence|Detect WMI Event Subscription Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1546.003/ T1546.003]
+[https://attack.mitre.org/techniques/T1546.003/ T1546.003], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
 |
-Windows Management Instrumentation Event Subscription
+Windows Management Instrumentation Event Subscription, 
+Event Triggered Execution
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
 | TTP
@@ -5953,10 +6722,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Wmi_permanent_event_subscription_-_sysmon|WMI Permanent Event Subscription - Sysmon]]
 
 |
-[https://attack.mitre.org/techniques/T1546.003/ T1546.003]
+[https://attack.mitre.org/techniques/T1546.003/ T1546.003], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
 |
-Windows Management Instrumentation Event Subscription
+Windows Management Instrumentation Event Subscription, 
+Event Triggered Execution
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
 | TTP
@@ -6012,13 +6784,30 @@ Monitor and detect registry changes initiated from remote locations, which can b
 ! Tactic
 ! Type
 |-
+| [[Documentation:ESSOC:detections:Detections#Disable_uac_remote_restriction|Disable UAC Remote Restriction]]
+
+|
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
+|
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
+|
+Privilege Escalation, Defense Evasion, 
+Privilege Escalation, Defense Evasion
+
+| TTP
+|-
 | [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -6026,10 +6815,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Monitor_registry_keys_for_print_monitors|Monitor Registry Keys for Print Monitors]]
 
 |
-[https://attack.mitre.org/techniques/T1547.010/ T1547.010]
+[https://attack.mitre.org/techniques/T1547.010/ T1547.010], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Port Monitors
+Port Monitors, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -6037,10 +6829,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Registry Run Keys / Startup Folder
+Registry Run Keys / Startup Folder, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -6048,10 +6843,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_privilege_escalation|Registry Keys Used For Privilege Escalation]]
 
 |
-[https://attack.mitre.org/techniques/T1546.012/ T1546.012]
+[https://attack.mitre.org/techniques/T1546.012/ T1546.012], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
 |
-Image File Execution Options Injection
+Image File Execution Options Injection, 
+Event Triggered Execution
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
 | TTP
@@ -6059,10 +6857,13 @@ Privilege Escalation, Persistence
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_for_creating_shim_databases|Registry Keys for Creating SHIM Databases]]
 
 |
-[https://attack.mitre.org/techniques/T1546.011/ T1546.011]
+[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
 |
-Application Shimming
+Application Shimming, 
+Event Triggered Execution
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
 | TTP
@@ -6072,6 +6873,8 @@ Privilege Escalation, Persistence
 
 * Actions on Objectives
 
+* Exploitation
+
 
 ====Reference====
 
@@ -6108,10 +6911,13 @@ Attackers are using Zoom as an vector to increase privileges on a sytems. This s
 | [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
+Command and Scripting Interpreter, 
 Windows Command Shell
 |
+Execution, 
 Execution
 
 | Hunting
@@ -6181,13 +6987,16 @@ Monitor and detect behaviors used by attackers who leverage trusted developer ut
 | [[Documentation:ESSOC:detections:Detections#Suspicious_microsoft_workflow_compiler_rename|Suspicious microsoft workflow compiler rename]]
 
 |
+[https://attack.mitre.org/techniques/T1036/ T1036], 
 [https://attack.mitre.org/techniques/T1127/ T1127], 
 [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
+Masquerading, 
 Trusted Developer Utilities Proxy Execution, 
 Rename System Utilities
 |
 Defense Evasion, 
+Defense Evasion, 
 Defense Evasion
 
 | Hunting
@@ -6243,27 +7052,50 @@ Monitor and detect techniques used by attackers who leverage the msbuild.exe pro
 ! Tactic
 ! Type
 |-
-| [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_rename|Suspicious MSBuild Rename]]
+| [[Documentation:ESSOC:detections:Detections#Msbuild_suspicious_spawned_by_script_process|MSBuild Suspicious Spawned By Script Process]]
 
 |
 [https://attack.mitre.org/techniques/T1127.001/ T1127.001], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
+[https://attack.mitre.org/techniques/T1127/ T1127]
 |
 MSBuild, 
-Rename System Utilities
+Trusted Developer Utilities Proxy Execution
 |
 Defense Evasion, 
 Defense Evasion
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_rename|Suspicious MSBuild Rename]]
+
+|
+[https://attack.mitre.org/techniques/T1036/ T1036], 
+[https://attack.mitre.org/techniques/T1127/ T1127], 
+[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
+[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
+|
+Masquerading, 
+Trusted Developer Utilities Proxy Execution, 
+Rename System Utilities, 
+MSBuild
+|
+Defense Evasion, 
+Defense Evasion, 
+Defense Evasion, 
+Defense Evasion
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_spawn|Suspicious MSBuild Spawn]]
 
 |
+[https://attack.mitre.org/techniques/T1127/ T1127], 
 [https://attack.mitre.org/techniques/T1127.001/ T1127.001]
 |
+Trusted Developer Utilities Proxy Execution, 
 MSBuild
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6271,13 +7103,19 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_msbuild_path|Suspicious msbuild path]]
 
 |
-[https://attack.mitre.org/techniques/T1127.001/ T1127.001], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
+[https://attack.mitre.org/techniques/T1036/ T1036], 
+[https://attack.mitre.org/techniques/T1127/ T1127], 
+[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
+[https://attack.mitre.org/techniques/T1127.001/ T1127.001]
 |
-MSBuild, 
-Rename System Utilities
+Masquerading, 
+Trusted Developer Utilities Proxy Execution, 
+Rename System Utilities, 
+MSBuild
 |
 Defense Evasion, 
+Defense Evasion, 
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6391,9 +7229,23 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 | [[Documentation:ESSOC:detections:Detections#Disable_registry_tool|Disable Registry Tool]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
+|
+Defense Evasion, 
+Defense Evasion
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Disable_security_logs_using_minint_registry|Disable Security Logs Using MiniNt Registry]]
+
+|
+[https://attack.mitre.org/techniques/T1112/ T1112]
+|
+Modify Registry
 |
 Defense Evasion
 
@@ -6403,23 +7255,46 @@ Defense Evasion
 
 |
 [https://attack.mitre.org/techniques/T1564.001/ T1564.001], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1564/ T1564], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
 Hidden Files and Directories, 
-Disable or Modify Tools
+Disable or Modify Tools, 
+Hide Artifacts, 
+Impair Defenses
 |
 Defense Evasion, 
+Defense Evasion, 
+Defense Evasion, 
 Defense Evasion
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Disable_uac_remote_restriction|Disable UAC Remote Restriction]]
+
+|
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
+|
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
+|
+Privilege Escalation, Defense Evasion, 
+Privilege Escalation, Defense Evasion
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6427,10 +7302,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disable_windows_smartscreen_protection|Disable Windows SmartScreen Protection]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6438,10 +7316,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disabling_cmd_application|Disabling CMD Application]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6449,10 +7330,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disabling_controlpanel|Disabling ControlPanel]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6460,10 +7344,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disabling_firewall_with_netsh|Disabling Firewall with Netsh]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6471,10 +7358,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disabling_folderoptions_windows_feature|Disabling FolderOptions Windows Feature]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6482,10 +7372,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disabling_norun_windows_app|Disabling NoRun Windows App]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6493,10 +7386,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -6504,10 +7400,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disabling_systemrestore_in_registry|Disabling SystemRestore In Registry]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6515,10 +7414,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disabling_task_manager|Disabling Task Manager]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6526,10 +7428,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Eventvwr_uac_bypass|Eventvwr UAC Bypass]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -6537,10 +7442,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Excessive_number_of_service_control_start_as_disabled|Excessive number of service control start as disabled]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | Anomaly
@@ -6549,12 +7457,15 @@ Defense Evasion
 
 |
 [https://attack.mitre.org/techniques/T1112/ T1112], 
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
 Modify Registry, 
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
 Defense Evasion, 
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -6562,10 +7473,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Hiding_files_and_directories_with_attrib_exe|Hiding Files And Directories With Attrib exe]]
 
 |
+[https://attack.mitre.org/techniques/T1222/ T1222], 
 [https://attack.mitre.org/techniques/T1222.001/ T1222.001]
 |
+File and Directory Permissions Modification, 
 Windows File and Directory Permissions Modification
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6573,10 +7487,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Net_profiler_uac_bypass|NET Profiler UAC bypass]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -6584,10 +7501,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Slui_runas_elevated|SLUI RunAs Elevated]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -6595,10 +7515,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Slui_spawning_a_process|SLUI Spawning a Process]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -6606,10 +7529,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Sdclt_uac_bypass|Sdclt UAC Bypass]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -6617,10 +7543,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Silentcleanup_uac_bypass|SilentCleanup UAC Bypass]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -6650,10 +7579,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Uac_bypass_mmc_load_unsigned_dll|UAC Bypass MMC Load Unsigned Dll]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -6661,10 +7593,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Wsreset_uac_bypass|WSReset UAC Bypass]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -6672,10 +7607,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Windows_disableantispyware_registry|Windows DisableAntiSpyware Registry]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -6810,32 +7748,35 @@ Reconnaissance
 | [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules|Reconnaissance and Access to Operating System Elements via PowerSploit modules]]
 
 |
-[https://attack.mitre.org/techniques/T1007/ T1007], 
-[https://attack.mitre.org/techniques/T1012/ T1012], 
-[https://attack.mitre.org/techniques/T1046/ T1046], 
-[https://attack.mitre.org/techniques/T1047/ T1047], 
 [https://attack.mitre.org/techniques/T1057/ T1057], 
 [https://attack.mitre.org/techniques/T1083/ T1083], 
-[https://attack.mitre.org/techniques/T1518/ T1518], 
-[https://attack.mitre.org/techniques/T1592.002/ T1592.002]
+[https://attack.mitre.org/techniques/T1592.002/ T1592.002], 
+[https://attack.mitre.org/techniques/T1046/ T1046], 
+[https://attack.mitre.org/techniques/T1012/ T1012], 
+[https://attack.mitre.org/techniques/T1007/ T1007], 
+[https://attack.mitre.org/techniques/T1047/ T1047], 
+[https://attack.mitre.org/techniques/T1592/ T1592], 
+[https://attack.mitre.org/techniques/T1518/ T1518]
 |
-System Service Discovery, 
-Query Registry, 
-Network Service Scanning, 
-Windows Management Instrumentation, 
 Process Discovery, 
 File and Directory Discovery, 
-Software Discovery, 
-Software
+Software, 
+Network Service Scanning, 
+Query Registry, 
+System Service Discovery, 
+Windows Management Instrumentation, 
+Gather Victim Host Information, 
+Software Discovery
 |
 Discovery, 
 Discovery, 
+Reconnaissance, 
+Discovery, 
+Discovery, 
 Discovery, 
 Execution, 
-Discovery, 
-Discovery, 
-Discovery, 
-Reconnaissance
+Reconnaissance, 
+Discovery
 
 | TTP
 |-
@@ -6859,34 +7800,40 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_shared_resources_via_mimikatz_modules|Reconnaissance and Access to Shared Resources via Mimikatz modules]]
 
 |
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
+[https://attack.mitre.org/techniques/T1021/ T1021], 
+[https://attack.mitre.org/techniques/T1039/ T1039], 
 [https://attack.mitre.org/techniques/T1135/ T1135], 
-[https://attack.mitre.org/techniques/T1039/ T1039]
+[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
 |
-SMB/Windows Admin Shares, 
+Remote Services, 
+Data from Network Shared Drive, 
 Network Share Discovery, 
-Data from Network Shared Drive
+SMB/Windows Admin Shares
 |
 Lateral Movement, 
+Collection, 
 Discovery, 
-Collection
+Lateral Movement
 
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Reconnaissance_and_access_to_shared_resources_via_powersploit_modules|Reconnaissance and Access to Shared Resources via PowerSploit modules]]
 
 |
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
+[https://attack.mitre.org/techniques/T1021/ T1021], 
+[https://attack.mitre.org/techniques/T1039/ T1039], 
 [https://attack.mitre.org/techniques/T1135/ T1135], 
-[https://attack.mitre.org/techniques/T1039/ T1039]
+[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
 |
-SMB/Windows Admin Shares, 
+Remote Services, 
+Data from Network Shared Drive, 
 Network Share Discovery, 
-Data from Network Shared Drive
+SMB/Windows Admin Shares
 |
 Lateral Movement, 
+Collection, 
 Discovery, 
-Collection
+Lateral Movement
 
 | TTP
 |-
@@ -6919,56 +7866,71 @@ Persistence, Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_connectivity_via_powersploit_modules|Reconnaissance of Connectivity via PowerSploit modules]]
 
 |
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
+[https://attack.mitre.org/techniques/T1021/ T1021], 
+[https://attack.mitre.org/techniques/T1039/ T1039], 
 [https://attack.mitre.org/techniques/T1135/ T1135], 
-[https://attack.mitre.org/techniques/T1039/ T1039]
+[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
 |
-SMB/Windows Admin Shares, 
+Remote Services, 
+Data from Network Shared Drive, 
 Network Share Discovery, 
-Data from Network Shared Drive
+SMB/Windows Admin Shares
 |
 Lateral Movement, 
+Collection, 
 Discovery, 
-Collection
+Lateral Movement
 
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_credential_stores_and_services_via_mimikatz_modules|Reconnaissance of Credential Stores and Services via Mimikatz modules]]
 
 |
-[https://attack.mitre.org/techniques/T1589.001/ T1589.001], 
+[https://attack.mitre.org/techniques/T1098/ T1098], 
 [https://attack.mitre.org/techniques/T1590.001/ T1590.001], 
-[https://attack.mitre.org/techniques/T1590.003/ T1590.003], 
-[https://attack.mitre.org/techniques/T1068/ T1068], 
 [https://attack.mitre.org/techniques/T1078/ T1078], 
-[https://attack.mitre.org/techniques/T1098/ T1098]
+[https://attack.mitre.org/techniques/T1589.001/ T1589.001], 
+[https://attack.mitre.org/techniques/T1590/ T1590], 
+[https://attack.mitre.org/techniques/T1068/ T1068], 
+[https://attack.mitre.org/techniques/T1589/ T1589], 
+[https://attack.mitre.org/techniques/T1590.003/ T1590.003]
 |
-Credentials, 
+Account Manipulation, 
 Domain Properties, 
-Network Trust Dependencies, 
-Exploitation for Privilege Escalation, 
 Valid Accounts, 
-Account Manipulation
+Credentials, 
+Gather Victim Network Information, 
+Exploitation for Privilege Escalation, 
+Gather Victim Identity Information, 
+Network Trust Dependencies
 |
+Persistence, 
 Reconnaissance, 
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Reconnaissance, 
 Reconnaissance, 
 Privilege Escalation, 
-Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
-Persistence
+Reconnaissance, 
+Reconnaissance
 
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Reconnaissance_of_defensive_tools_via_powersploit_modules|Reconnaissance of Defensive Tools via PowerSploit modules]]
 
 |
+[https://attack.mitre.org/techniques/T1592.002/ T1592.002], 
 [https://attack.mitre.org/techniques/T1595.002/ T1595.002], 
-[https://attack.mitre.org/techniques/T1592.002/ T1592.002]
+[https://attack.mitre.org/techniques/T1592/ T1592], 
+[https://attack.mitre.org/techniques/T1595/ T1595]
 |
+Software, 
 Vulnerability Scanning, 
-Software
+Gather Victim Host Information, 
+Active Scanning
 |
 Reconnaissance, 
+Reconnaissance, 
+Reconnaissance, 
 Reconnaissance
 
 | TTP
@@ -7072,10 +8034,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -7083,10 +8048,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]
 
 |
-[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
+[https://attack.mitre.org/techniques/T1070.001/ T1070.001], 
+[https://attack.mitre.org/techniques/T1070/ T1070]
 |
-Clear Windows Event Logs
+Clear Windows Event Logs, 
+Indicator Removal on Host
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -7105,10 +8073,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -7116,10 +8087,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_disable_logs|Wevtutil Usage To Disable Logs]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -7127,10 +8101,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Windows_event_log_cleared|Windows Event Log Cleared]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -7177,32 +8154,83 @@ Monitor for activities and techniques associated with maintaining persistence on
 ! Tactic
 ! Type
 |-
+| [[Documentation:ESSOC:detections:Detections#Active_setup_registry_autostart|Active Setup Registry Autostart]]
+
+|
+[https://attack.mitre.org/techniques/T1547.014/ T1547.014], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
+|
+Active Setup, 
+Boot or Logon Autostart Execution
+|
+Persistence, Privilege Escalation, 
+Persistence, Privilege Escalation
+
+| TTP
+|-
 | [[Documentation:ESSOC:detections:Detections#Certutil_exe_certificate_extraction|Certutil exe certificate extraction]]
 
 |
 |
 |
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Change_default_file_association|Change Default File Association]]
+
+|
+[https://attack.mitre.org/techniques/T1546.001/ T1546.001], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
+|
+Change Default File Association, 
+Event Triggered Execution
+|
+Privilege Escalation, Persistence, 
+Privilege Escalation, Persistence
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Detect_path_interception_by_creation_of_program_exe|Detect Path Interception By Creation Of program exe]]
 
 |
-[https://attack.mitre.org/techniques/T1574.009/ T1574.009]
+[https://attack.mitre.org/techniques/T1574.009/ T1574.009], 
+[https://attack.mitre.org/techniques/T1574/ T1574]
 |
-Path Interception by Unquoted Path
+Path Interception by Unquoted Path, 
+Hijack Execution Flow
 |
+Persistence, Privilege Escalation, Defense Evasion, 
 Persistence, Privilege Escalation, Defense Evasion
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Etw_registry_disabled|ETW Registry Disabled]]
+
+|
+[https://attack.mitre.org/techniques/T1562.006/ T1562.006], 
+[https://attack.mitre.org/techniques/T1127/ T1127], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
+|
+Indicator Blocking, 
+Trusted Developer Utilities Proxy Execution, 
+Impair Defenses
+|
+Defense Evasion, 
+Defense Evasion, 
+Defense Evasion
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Hiding_files_and_directories_with_attrib_exe|Hiding Files And Directories With Attrib exe]]
 
 |
+[https://attack.mitre.org/techniques/T1222/ T1222], 
 [https://attack.mitre.org/techniques/T1222.001/ T1222.001]
 |
+File and Directory Permissions Modification, 
 Windows File and Directory Permissions Modification
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -7281,15 +8309,46 @@ Execution, Persistence, Privilege Escalation,
 Defense Evasion, Privilege Escalation, 
 Privilege Escalation, Defense Evasion
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Logon_script_event_trigger_execution|Logon Script Event Trigger Execution]]
+
+|
+[https://attack.mitre.org/techniques/T1037/ T1037], 
+[https://attack.mitre.org/techniques/T1037.001/ T1037.001]
+|
+Boot or Logon Initialization Scripts, 
+Logon Script (Windows)
+|
+Persistence, Privilege Escalation, 
+Persistence, Privilege Escalation
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Monitor_registry_keys_for_print_monitors|Monitor Registry Keys for Print Monitors]]
 
 |
-[https://attack.mitre.org/techniques/T1547.010/ T1547.010]
+[https://attack.mitre.org/techniques/T1547.010/ T1547.010], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Port Monitors
+Port Monitors, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
+Persistence, Privilege Escalation
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Print_processor_registry_autostart|Print Processor Registry Autostart]]
+
+|
+[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
+|
+Print Processors, 
+Boot or Logon Autostart Execution
+|
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -7297,10 +8356,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Reg_exe_manipulating_windows_services_registry_keys|Reg exe Manipulating Windows Services Registry Keys]]
 
 |
-[https://attack.mitre.org/techniques/T1574.011/ T1574.011]
+[https://attack.mitre.org/techniques/T1574.011/ T1574.011], 
+[https://attack.mitre.org/techniques/T1574/ T1574]
 |
-Services Registry Permissions Weakness
+Services Registry Permissions Weakness, 
+Hijack Execution Flow
 |
+Persistence, Privilege Escalation, Defense Evasion, 
 Persistence, Privilege Escalation, Defense Evasion
 
 | TTP
@@ -7308,10 +8370,13 @@ Persistence, Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Registry Run Keys / Startup Folder
+Registry Run Keys / Startup Folder, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -7319,10 +8384,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_for_creating_shim_databases|Registry Keys for Creating SHIM Databases]]
 
 |
-[https://attack.mitre.org/techniques/T1546.011/ T1546.011]
+[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
 |
-Application Shimming
+Application Shimming, 
+Event Triggered Execution
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
 | TTP
@@ -7330,10 +8398,13 @@ Privilege Escalation, Persistence
 | [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
 
 |
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
+[https://attack.mitre.org/techniques/T1543/ T1543]
 |
-Windows Service
+Windows Service, 
+Create or Modify System Process
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -7363,12 +8434,29 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Schtasks_used_for_forcing_a_reboot|Schtasks used for forcing a reboot]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Screensaver_event_trigger_execution|Screensaver Event Trigger Execution]]
+
+|
+[https://attack.mitre.org/techniques/T1546/ T1546], 
+[https://attack.mitre.org/techniques/T1546.002/ T1546.002]
+|
+Event Triggered Execution, 
+Screensaver
+|
+Privilege Escalation, Persistence, 
+Privilege Escalation, Persistence
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Setting_credentials_via_dsinternals_modules|Setting Credentials via DSInternals modules]]
@@ -7425,10 +8513,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#Shim_database_file_creation|Shim Database File Creation]]
 
 |
-[https://attack.mitre.org/techniques/T1546.011/ T1546.011]
+[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
 |
-Application Shimming
+Application Shimming, 
+Event Triggered Execution
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
 | TTP
@@ -7436,10 +8527,13 @@ Privilege Escalation, Persistence
 | [[Documentation:ESSOC:detections:Detections#Shim_database_installation_with_suspicious_parameters|Shim Database Installation With Suspicious Parameters]]
 
 |
-[https://attack.mitre.org/techniques/T1546.011/ T1546.011]
+[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
 |
-Application Shimming
+Application Shimming, 
+Event Triggered Execution
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
 | TTP
@@ -7447,21 +8541,41 @@ Privilege Escalation, Persistence
 | [[Documentation:ESSOC:detections:Detections#Suspicious_scheduled_task_from_public_directory|Suspicious Scheduled Task from Public Directory]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | Anomaly
 |-
+| [[Documentation:ESSOC:detections:Detections#Time_provider_persistence_registry|Time Provider Persistence Registry]]
+
+|
+[https://attack.mitre.org/techniques/T1547.003/ T1547.003], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
+|
+Time Providers, 
+Boot or Logon Autostart Execution
+|
+Persistence, Privilege Escalation, 
+Persistence, Privilege Escalation
+
+| TTP
+|-
 | [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -7469,10 +8583,13 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_to_spawn_shell|WinEvent Scheduled Task Created to Spawn Shell]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -7527,6 +8644,34 @@ Monitor for and investigate activities that may be associated with a Windows pri
 ! Tactic
 ! Type
 |-
+| [[Documentation:ESSOC:detections:Detections#Active_setup_registry_autostart|Active Setup Registry Autostart]]
+
+|
+[https://attack.mitre.org/techniques/T1547.014/ T1547.014], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
+|
+Active Setup, 
+Boot or Logon Autostart Execution
+|
+Persistence, Privilege Escalation, 
+Persistence, Privilege Escalation
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Change_default_file_association|Change Default File Association]]
+
+|
+[https://attack.mitre.org/techniques/T1546.001/ T1546.001], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
+|
+Change Default File Association, 
+Event Triggered Execution
+|
+Privilege Escalation, Persistence, 
+Privilege Escalation, Persistence
+
+| TTP
+|-
 | [[Documentation:ESSOC:detections:Detections#Child_processes_of_spoolsv_exe|Child Processes of Spoolsv exe]]
 
 |
@@ -7536,6 +8681,23 @@ Exploitation for Privilege Escalation
 |
 Privilege Escalation
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Etw_registry_disabled|ETW Registry Disabled]]
+
+|
+[https://attack.mitre.org/techniques/T1562.006/ T1562.006], 
+[https://attack.mitre.org/techniques/T1127/ T1127], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
+|
+Indicator Blocking, 
+Trusted Developer Utilities Proxy Execution, 
+Impair Defenses
+|
+Defense Evasion, 
+Defense Evasion, 
+Defense Evasion
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Illegal_privilege_elevation_via_mimikatz_modules|Illegal Privilege Elevation via Mimikatz modules]]
@@ -7550,17 +8712,48 @@ Abuse Elevation Control Mechanism
 Defense Evasion, Privilege Escalation, 
 Privilege Escalation, Defense Evasion
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Logon_script_event_trigger_execution|Logon Script Event Trigger Execution]]
+
+|
+[https://attack.mitre.org/techniques/T1037/ T1037], 
+[https://attack.mitre.org/techniques/T1037.001/ T1037.001]
+|
+Boot or Logon Initialization Scripts, 
+Logon Script (Windows)
+|
+Persistence, Privilege Escalation, 
+Persistence, Privilege Escalation
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Overwriting_accessibility_binaries|Overwriting Accessibility Binaries]]
 
 |
+[https://attack.mitre.org/techniques/T1546/ T1546], 
 [https://attack.mitre.org/techniques/T1546.008/ T1546.008]
 |
+Event Triggered Execution, 
 Accessibility Features
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Print_processor_registry_autostart|Print Processor Registry Autostart]]
+
+|
+[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
+|
+Print Processors, 
+Boot or Logon Autostart Execution
+|
+Persistence, Privilege Escalation, 
+Persistence, Privilege Escalation
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Probing_access_with_stolen_credentials_via_powersploit_modules|Probing Access with Stolen Credentials via PowerSploit modules]]
@@ -7580,12 +8773,43 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_privilege_escalation|Registry Keys Used For Privilege Escalation]]
 
 |
-[https://attack.mitre.org/techniques/T1546.012/ T1546.012]
+[https://attack.mitre.org/techniques/T1546.012/ T1546.012], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
 |
-Image File Execution Options Injection
+Image File Execution Options Injection, 
+Event Triggered Execution
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Screensaver_event_trigger_execution|Screensaver Event Trigger Execution]]
+
+|
+[https://attack.mitre.org/techniques/T1546/ T1546], 
+[https://attack.mitre.org/techniques/T1546.002/ T1546.002]
+|
+Event Triggered Execution, 
+Screensaver
+|
+Privilege Escalation, Persistence, 
+Privilege Escalation, Persistence
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Time_provider_persistence_registry|Time Provider Persistence Registry]]
+
+|
+[https://attack.mitre.org/techniques/T1547.003/ T1547.003], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
+|
+Time Providers, 
+Boot or Logon Autostart Execution
+|
+Persistence, Privilege Escalation, 
+Persistence, Privilege Escalation
+
 | TTP
 |}
 
@@ -7724,10 +8948,13 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 | [[Documentation:ESSOC:detections:Detections#Allow_inbound_traffic_by_firewall_rule_registry|Allow Inbound Traffic By Firewall Rule Registry]]
 
 |
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001]
+[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-Remote Desktop Protocol
+Remote Desktop Protocol, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | TTP
@@ -7735,10 +8962,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Allow_inbound_traffic_in_firewall_rule|Allow Inbound Traffic In Firewall Rule]]
 
 |
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001]
+[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-Remote Desktop Protocol
+Remote Desktop Protocol, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | TTP
@@ -7779,10 +9009,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Protocol_or_port_mismatch|Protocol or Port Mismatch]]
 
 |
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003]
+[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
+Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
+Exfiltration Over Alternative Protocol
 |
+Exfiltration, 
 Exfiltration
 
 | Anomaly
@@ -7790,10 +9023,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]
 
 |
+[https://attack.mitre.org/techniques/T1071/ T1071], 
 [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
 |
+Application Layer Protocol, 
 Web Protocols
 |
+Command And Control, 
 Command And Control
 
 | TTP
@@ -7845,14 +9081,17 @@ Validate the security configuration of network infrastructure and verify that on
 |
 [https://attack.mitre.org/techniques/T1200/ T1200], 
 [https://attack.mitre.org/techniques/T1498/ T1498], 
+[https://attack.mitre.org/techniques/T1557/ T1557], 
 [https://attack.mitre.org/techniques/T1557.002/ T1557.002]
 |
 Hardware Additions, 
 Network Denial of Service, 
+Man-in-the-Middle, 
 ARP Cache Poisoning
 |
 Initial Access, 
 Impact, 
+Credential Access, Collection, 
 Credential Access, Collection
 
 | TTP
@@ -7862,14 +9101,17 @@ Credential Access, Collection
 |
 [https://attack.mitre.org/techniques/T1200/ T1200], 
 [https://attack.mitre.org/techniques/T1498/ T1498], 
+[https://attack.mitre.org/techniques/T1557/ T1557], 
 [https://attack.mitre.org/techniques/T1557.002/ T1557.002]
 |
 Hardware Additions, 
 Network Denial of Service, 
+Man-in-the-Middle, 
 ARP Cache Poisoning
 |
 Initial Access, 
 Impact, 
+Credential Access, Collection, 
 Credential Access, Collection
 
 | TTP
@@ -7887,14 +9129,17 @@ Credential Access, Collection
 |
 [https://attack.mitre.org/techniques/T1200/ T1200], 
 [https://attack.mitre.org/techniques/T1498/ T1498], 
+[https://attack.mitre.org/techniques/T1557/ T1557], 
 [https://attack.mitre.org/techniques/T1557.002/ T1557.002]
 |
 Hardware Additions, 
 Network Denial of Service, 
+Man-in-the-Middle, 
 ARP Cache Poisoning
 |
 Initial Access, 
 Impact, 
+Credential Access, Collection, 
 Credential Access, Collection
 
 | TTP
@@ -7919,10 +9164,13 @@ Credential Access, Collection
 | [[Documentation:ESSOC:detections:Detections#Detect_software_download_to_network_device|Detect Software Download To Network Device]]
 
 |
-[https://attack.mitre.org/techniques/T1542.005/ T1542.005]
+[https://attack.mitre.org/techniques/T1542.005/ T1542.005], 
+[https://attack.mitre.org/techniques/T1542/ T1542]
 |
-TFTP Boot
+TFTP Boot, 
+Pre-OS Boot
 |
+Defense Evasion, Persistence, 
 Defense Evasion, Persistence
 
 | TTP
@@ -7931,14 +9179,17 @@ Defense Evasion, Persistence
 
 |
 [https://attack.mitre.org/techniques/T1200/ T1200], 
+[https://attack.mitre.org/techniques/T1020/ T1020], 
 [https://attack.mitre.org/techniques/T1498/ T1498], 
 [https://attack.mitre.org/techniques/T1020.001/ T1020.001]
 |
 Hardware Additions, 
+Automated Exfiltration, 
 Network Denial of Service, 
 Traffic Duplication
 |
 Initial Access, 
+Exfiltration, 
 Impact, 
 Exfiltration
 
@@ -8133,10 +9384,13 @@ This analytic story contains detections that query your AWS Cloudtrail for activ
 | [[Documentation:ESSOC:detections:Detections#Aws_create_policy_version_to_allow_all_resources|AWS Create Policy Version to allow all resources]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
+[https://attack.mitre.org/techniques/T1078/ T1078]
 |
-Cloud Accounts
+Cloud Accounts, 
+Valid Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | TTP
@@ -8144,10 +9398,13 @@ Defense Evasion, Persistence, Privilege Escalation, Initial Access
 | [[Documentation:ESSOC:detections:Detections#Aws_createaccesskey|AWS CreateAccessKey]]
 
 |
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003]
+[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Cloud Account
+Cloud Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | Hunting
@@ -8155,10 +9412,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#Aws_createloginprofile|AWS CreateLoginProfile]]
 
 |
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003]
+[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Cloud Account
+Cloud Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -8203,23 +9463,29 @@ Persistence
 
 |
 [https://attack.mitre.org/techniques/T1069.003/ T1069.003], 
-[https://attack.mitre.org/techniques/T1098/ T1098]
+[https://attack.mitre.org/techniques/T1098/ T1098], 
+[https://attack.mitre.org/techniques/T1069/ T1069]
 |
 Cloud Groups, 
-Account Manipulation
+Account Manipulation, 
+Permission Groups Discovery
 |
 Discovery, 
-Persistence
+Persistence, 
+Discovery
 
 | Hunting
 |-
 | [[Documentation:ESSOC:detections:Detections#Aws_setdefaultpolicyversion|AWS SetDefaultPolicyVersion]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
+[https://attack.mitre.org/techniques/T1078/ T1078]
 |
-Cloud Accounts
+Cloud Accounts, 
+Valid Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | TTP
@@ -8227,10 +9493,13 @@ Defense Evasion, Persistence, Privilege Escalation, Initial Access
 | [[Documentation:ESSOC:detections:Detections#Aws_updateloginprofile|AWS UpdateLoginProfile]]
 
 |
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003]
+[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Cloud Account
+Cloud Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -8280,10 +9549,13 @@ Monitor your AWS network infrastructure for bad configurations and malicious act
 | [[Documentation:ESSOC:detections:Detections#Aws_network_access_control_list_created_with_all_open_ports|AWS Network Access Control List Created with All Open Ports]]
 
 |
-[https://attack.mitre.org/techniques/T1562.007/ T1562.007]
+[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Cloud Firewall
+Disable or Modify Cloud Firewall, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -8291,10 +9563,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Aws_network_access_control_list_deleted|AWS Network Access Control List Deleted]]
 
 |
-[https://attack.mitre.org/techniques/T1562.007/ T1562.007]
+[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Cloud Firewall
+Disable or Modify Cloud Firewall, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | Anomaly
@@ -8449,10 +9724,13 @@ Monitor your cloud compute instances for activities related to cryptojacking/cry
 | [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_launched|Abnormally High Number Of Cloud Instances Launched]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
+[https://attack.mitre.org/techniques/T1078/ T1078]
 |
-Cloud Accounts
+Cloud Accounts, 
+Valid Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
@@ -8460,10 +9738,13 @@ Defense Evasion, Persistence, Privilege Escalation, Initial Access
 | [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_by_previously_unseen_user|Cloud Compute Instance Created By Previously Unseen User]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
+[https://attack.mitre.org/techniques/T1078/ T1078]
 |
-Cloud Accounts
+Cloud Accounts, 
+Valid Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
@@ -8564,10 +9845,13 @@ Defense Evasion, Persistence, Privilege Escalation, Initial Access
 | [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -8583,10 +9867,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#O365_add_app_role_assignment_grant_user|O365 Add App Role Assignment Grant User]]
 
 |
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003]
+[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Cloud Account
+Cloud Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -8594,10 +9881,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#O365_added_service_principal|O365 Added Service Principal]]
 
 |
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003]
+[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Cloud Account
+Cloud Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -8616,10 +9906,13 @@ Credential Access, Defense Evasion, Persistence
 | [[Documentation:ESSOC:detections:Detections#O365_new_federated_domain_added|O365 New Federated Domain Added]]
 
 |
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003]
+[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Cloud Account
+Cloud Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -8627,10 +9920,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_privilege_escalation|Registry Keys Used For Privilege Escalation]]
 
 |
-[https://attack.mitre.org/techniques/T1546.012/ T1546.012]
+[https://attack.mitre.org/techniques/T1546.012/ T1546.012], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
 |
-Image File Execution Options Injection
+Image File Execution Options Injection, 
+Event Triggered Execution
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
 | TTP
@@ -8729,10 +10025,13 @@ This story is focused around detecting attacks on a DevSecOps lifeccycle which c
 | [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_high|AWS ECR Container Scanning Findings High]]
 
 |
-[https://attack.mitre.org/techniques/T1204.003/ T1204.003]
+[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
+[https://attack.mitre.org/techniques/T1204/ T1204]
 |
-Malicious Image
+Malicious Image, 
+User Execution
 |
+Execution, 
 Execution
 
 | TTP
@@ -8740,10 +10039,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_low_informational_unknown|AWS ECR Container Scanning Findings Low Informational Unknown]]
 
 |
-[https://attack.mitre.org/techniques/T1204.003/ T1204.003]
+[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
+[https://attack.mitre.org/techniques/T1204/ T1204]
 |
-Malicious Image
+Malicious Image, 
+User Execution
 |
+Execution, 
 Execution
 
 | Hunting
@@ -8751,10 +10053,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_medium|AWS ECR Container Scanning Findings Medium]]
 
 |
-[https://attack.mitre.org/techniques/T1204.003/ T1204.003]
+[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
+[https://attack.mitre.org/techniques/T1204/ T1204]
 |
-Malicious Image
+Malicious Image, 
+User Execution
 |
+Execution, 
 Execution
 
 | Anomaly
@@ -8762,10 +10067,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_upload_outside_business_hours|AWS ECR Container Upload Outside Business Hours]]
 
 |
-[https://attack.mitre.org/techniques/T1204.003/ T1204.003]
+[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
+[https://attack.mitre.org/techniques/T1204/ T1204]
 |
-Malicious Image
+Malicious Image, 
+User Execution
 |
+Execution, 
 Execution
 
 | Anomaly
@@ -8773,10 +10081,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_upload_unknown_user|AWS ECR Container Upload Unknown User]]
 
 |
-[https://attack.mitre.org/techniques/T1204.003/ T1204.003]
+[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
+[https://attack.mitre.org/techniques/T1204/ T1204]
 |
-Malicious Image
+Malicious Image, 
+User Execution
 |
+Execution, 
 Execution
 
 | Anomaly
@@ -8806,10 +10117,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#Correlation_by_repository_and_risk|Correlation by Repository and Risk]]
 
 |
-[https://attack.mitre.org/techniques/T1204.003/ T1204.003]
+[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
+[https://attack.mitre.org/techniques/T1204/ T1204]
 |
-Malicious Image
+Malicious Image, 
+User Execution
 |
+Execution, 
 Execution
 
 | Correlation
@@ -8817,21 +10131,41 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Correlation_by_user_and_risk|Correlation by User and Risk]]
 
 |
-[https://attack.mitre.org/techniques/T1204.003/ T1204.003]
+[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
+[https://attack.mitre.org/techniques/T1204/ T1204]
 |
-Malicious Image
+Malicious Image, 
+User Execution
 |
+Execution, 
 Execution
 
 | Correlation
 |-
+| [[Documentation:ESSOC:detections:Detections#Gsuite_email_suspicious_attachment|GSuite Email Suspicious Attachment]]
+
+|
+[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
+[https://attack.mitre.org/techniques/T1566/ T1566]
+|
+Spearphishing Attachment, 
+Phishing
+|
+Initial Access, 
+Initial Access
+
+| Anomaly
+|-
 | [[Documentation:ESSOC:detections:Detections#Github_dependabot_alert|GitHub Dependabot Alert]]
 
 |
-[https://attack.mitre.org/techniques/T1195.001/ T1195.001]
+[https://attack.mitre.org/techniques/T1195.001/ T1195.001], 
+[https://attack.mitre.org/techniques/T1195/ T1195]
 |
-Compromise Software Dependencies and Development Tools
+Compromise Software Dependencies and Development Tools, 
+Supply Chain Compromise
 |
+Initial Access, 
 Initial Access
 
 | Anomaly
@@ -8839,10 +10173,105 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Github_pull_request_from_unknown_user|GitHub Pull Request from Unknown User]]
 
 |
-[https://attack.mitre.org/techniques/T1195.001/ T1195.001]
+[https://attack.mitre.org/techniques/T1195.001/ T1195.001], 
+[https://attack.mitre.org/techniques/T1195/ T1195]
 |
-Compromise Software Dependencies and Development Tools
+Compromise Software Dependencies and Development Tools, 
+Supply Chain Compromise
 |
+Initial Access, 
+Initial Access
+
+| Anomaly
+|-
+| [[Documentation:ESSOC:detections:Detections#Github_commit_changes_in_master|Github Commit Changes In Master]]
+
+|
+[https://attack.mitre.org/techniques/T1199/ T1199]
+|
+Trusted Relationship
+|
+Initial Access
+
+| Anomaly
+|-
+| [[Documentation:ESSOC:detections:Detections#Github_commit_in_develop|Github Commit In Develop]]
+
+|
+[https://attack.mitre.org/techniques/T1199/ T1199]
+|
+Trusted Relationship
+|
+Initial Access
+
+| Anomaly
+|-
+| [[Documentation:ESSOC:detections:Detections#Gsuite_drive_share_in_external_email|Gsuite Drive Share In External Email]]
+
+|
+[https://attack.mitre.org/techniques/T1567.002/ T1567.002], 
+[https://attack.mitre.org/techniques/T1567/ T1567]
+|
+Exfiltration to Cloud Storage, 
+Exfiltration Over Web Service
+|
+Exfiltration, 
+Exfiltration
+
+| Anomaly
+|-
+| [[Documentation:ESSOC:detections:Detections#Gsuite_email_suspicious_subject_with_attachment|Gsuite Email Suspicious Subject With Attachment]]
+
+|
+[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
+[https://attack.mitre.org/techniques/T1566/ T1566]
+|
+Spearphishing Attachment, 
+Phishing
+|
+Initial Access, 
+Initial Access
+
+| Anomaly
+|-
+| [[Documentation:ESSOC:detections:Detections#Gsuite_email_with_known_abuse_web_service_link|Gsuite Email With Known Abuse Web Service Link]]
+
+|
+[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
+[https://attack.mitre.org/techniques/T1566/ T1566]
+|
+Spearphishing Attachment, 
+Phishing
+|
+Initial Access, 
+Initial Access
+
+| Anomaly
+|-
+| [[Documentation:ESSOC:detections:Detections#Gsuite_outbound_email_with_attachment_to_external_domain|Gsuite Outbound Email With Attachment To External Domain]]
+
+|
+[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
+[https://attack.mitre.org/techniques/T1048/ T1048]
+|
+Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
+Exfiltration Over Alternative Protocol
+|
+Exfiltration, 
+Exfiltration
+
+| Anomaly
+|-
+| [[Documentation:ESSOC:detections:Detections#Gsuite_suspicious_shared_file_name|Gsuite Suspicious Shared File Name]]
+
+|
+[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
+[https://attack.mitre.org/techniques/T1566/ T1566]
+|
+Spearphishing Attachment, 
+Phishing
+|
+Initial Access, 
 Initial Access
 
 | Anomaly
@@ -8885,6 +10314,10 @@ Discovery
 
 * Actions on Objectives
 
+* Exfiltration
+
+* Exploitation
+
 
 ====Reference====
 
@@ -9079,10 +10512,13 @@ This story is focused around detecting Office 365 Attacks.
 | [[Documentation:ESSOC:detections:Detections#High_number_of_login_failures_from_a_single_source|High Number of Login Failures from a single source]]
 
 |
-[https://attack.mitre.org/techniques/T1110.001/ T1110.001]
+[https://attack.mitre.org/techniques/T1110.001/ T1110.001], 
+[https://attack.mitre.org/techniques/T1110/ T1110]
 |
-Password Guessing
+Password Guessing, 
+Brute Force
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -9090,10 +10526,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#O365_add_app_role_assignment_grant_user|O365 Add App Role Assignment Grant User]]
 
 |
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003]
+[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Cloud Account
+Cloud Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -9101,10 +10540,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#O365_added_service_principal|O365 Added Service Principal]]
 
 |
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003]
+[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Cloud Account
+Cloud Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -9112,10 +10554,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#O365_bypass_mfa_via_trusted_ip|O365 Bypass MFA via Trusted IP]]
 
 |
-[https://attack.mitre.org/techniques/T1562.007/ T1562.007]
+[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Cloud Firewall
+Disable or Modify Cloud Firewall, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -9156,10 +10601,13 @@ Credential Access, Defense Evasion, Persistence
 | [[Documentation:ESSOC:detections:Detections#O365_new_federated_domain_added|O365 New Federated Domain Added]]
 
 |
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003]
+[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Cloud Account
+Cloud Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -9178,10 +10626,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#O365_suspicious_admin_email_forwarding|O365 Suspicious Admin Email Forwarding]]
 
 |
-[https://attack.mitre.org/techniques/T1114.003/ T1114.003]
+[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
+[https://attack.mitre.org/techniques/T1114/ T1114]
 |
-Email Forwarding Rule
+Email Forwarding Rule, 
+Email Collection
 |
+Collection, 
 Collection
 
 | Anomaly
@@ -9189,10 +10640,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#O365_suspicious_rights_delegation|O365 Suspicious Rights Delegation]]
 
 |
-[https://attack.mitre.org/techniques/T1114.002/ T1114.002]
+[https://attack.mitre.org/techniques/T1114.002/ T1114.002], 
+[https://attack.mitre.org/techniques/T1114/ T1114]
 |
-Remote Email Collection
+Remote Email Collection, 
+Email Collection
 |
+Collection, 
 Collection
 
 | TTP
@@ -9200,10 +10654,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#O365_suspicious_user_email_forwarding|O365 Suspicious User Email Forwarding]]
 
 |
-[https://attack.mitre.org/techniques/T1114.003/ T1114.003]
+[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
+[https://attack.mitre.org/techniques/T1114/ T1114]
 |
-Email Forwarding Rule
+Email Forwarding Rule, 
+Email Collection
 |
+Collection, 
 Collection
 
 | Anomaly
@@ -9535,10 +10992,13 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 | [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_destroyed|Abnormally High Number Of Cloud Instances Destroyed]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
+[https://attack.mitre.org/techniques/T1078/ T1078]
 |
-Cloud Accounts
+Cloud Accounts, 
+Valid Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
@@ -9546,10 +11006,13 @@ Defense Evasion, Persistence, Privilege Escalation, Initial Access
 | [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_launched|Abnormally High Number Of Cloud Instances Launched]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
+[https://attack.mitre.org/techniques/T1078/ T1078]
 |
-Cloud Accounts
+Cloud Accounts, 
+Valid Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
@@ -9557,10 +11020,13 @@ Defense Evasion, Persistence, Privilege Escalation, Initial Access
 | [[Documentation:ESSOC:detections:Detections#Cloud_instance_modified_by_previously_unseen_user|Cloud Instance Modified By Previously Unseen User]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
+[https://attack.mitre.org/techniques/T1078/ T1078]
 |
-Cloud Accounts
+Cloud Accounts, 
+Valid Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
@@ -9704,10 +11170,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_infrastructure_api_calls|Abnormally High Number Of Cloud Infrastructure API Calls]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
+[https://attack.mitre.org/techniques/T1078/ T1078]
 |
-Cloud Accounts
+Cloud Accounts, 
+Valid Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
@@ -9715,10 +11184,13 @@ Defense Evasion, Persistence, Privilege Escalation, Initial Access
 | [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_security_group_api_calls|Abnormally High Number Of Cloud Security Group API Calls]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
+[https://attack.mitre.org/techniques/T1078/ T1078]
 |
-Cloud Accounts
+Cloud Accounts, 
+Valid Accounts
 |
+Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
@@ -9842,10 +11314,13 @@ The following analytic story identifies behaviors related PrintNightmare, or CVE
 | [[Documentation:ESSOC:detections:Detections#Print_spooler_adding_a_printer_driver|Print Spooler Adding A Printer Driver]]
 
 |
-[https://attack.mitre.org/techniques/T1547.012/ T1547.012]
+[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Print Processors
+Print Processors, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -9853,10 +11328,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Print_spooler_failed_to_load_a_plug-in|Print Spooler Failed to Load a Plug-in]]
 
 |
-[https://attack.mitre.org/techniques/T1547.012/ T1547.012]
+[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Print Processors
+Print Processors, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -9864,10 +11342,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Rundll32_with_no_command_line_arguments_with_network|Rundll32 with no Command Line Arguments with Network]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -9875,10 +11356,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Spoolsv_spawning_rundll32|Spoolsv Spawning Rundll32]]
 
 |
-[https://attack.mitre.org/techniques/T1547.012/ T1547.012]
+[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Print Processors
+Print Processors, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -9886,10 +11370,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Spoolsv_suspicious_loaded_modules|Spoolsv Suspicious Loaded Modules]]
 
 |
-[https://attack.mitre.org/techniques/T1547.012/ T1547.012]
+[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Print Processors
+Print Processors, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -9908,10 +11395,13 @@ Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Spoolsv_writing_a_dll|Spoolsv Writing a DLL]]
 
 |
-[https://attack.mitre.org/techniques/T1547.012/ T1547.012]
+[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Print Processors
+Print Processors, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -9919,10 +11409,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Spoolsv_writing_a_dll_-_sysmon|Spoolsv Writing a DLL - Sysmon]]
 
 |
-[https://attack.mitre.org/techniques/T1547.012/ T1547.012]
+[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Print Processors
+Print Processors, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -9930,10 +11423,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_no_command_line_arguments|Suspicious Rundll32 no Command Line Arguments]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -9990,10 +11486,13 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Add_defaultuser_and_password_in_registry|Add DefaultUser And Password In Registry]]
 
 |
-[https://attack.mitre.org/techniques/T1552.002/ T1552.002]
+[https://attack.mitre.org/techniques/T1552.002/ T1552.002], 
+[https://attack.mitre.org/techniques/T1552/ T1552]
 |
-Credentials in Registry
+Credentials in Registry, 
+Unsecured Credentials
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -10001,10 +11500,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Auto_admin_logon_registry_entry|Auto Admin Logon Registry Entry]]
 
 |
-[https://attack.mitre.org/techniques/T1552.002/ T1552.002]
+[https://attack.mitre.org/techniques/T1552.002/ T1552.002], 
+[https://attack.mitre.org/techniques/T1552/ T1552]
 |
-Credentials in Registry
+Credentials in Registry, 
+Unsecured Credentials
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -10153,10 +11655,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Create_service_in_suspicious_file_path|Create Service In Suspicious File Path]]
 
 |
+[https://attack.mitre.org/techniques/T1569/ T1569], 
 [https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
+System Services, 
 Service Execution
 |
+Execution, 
 Execution
 
 | TTP
@@ -10241,10 +11746,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -10252,10 +11760,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]
 
 |
-[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
+[https://attack.mitre.org/techniques/T1070.001/ T1070.001], 
+[https://attack.mitre.org/techniques/T1070/ T1070]
 |
-Clear Windows Event Logs
+Clear Windows Event Logs, 
+Indicator Removal on Host
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -10263,10 +11774,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -10274,10 +11788,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Windows_event_log_cleared|Windows Event Log Cleared]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -10379,10 +11896,13 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 | [[Documentation:ESSOC:detections:Detections#Create_local_admin_accounts_using_net_exe|Create local admin accounts using net exe]]
 
 |
-[https://attack.mitre.org/techniques/T1136.001/ T1136.001]
+[https://attack.mitre.org/techniques/T1136.001/ T1136.001], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Local Account
+Local Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -10390,10 +11910,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#Detect_new_local_admin_account|Detect New Local Admin account]]
 
 |
-[https://attack.mitre.org/techniques/T1136.001/ T1136.001]
+[https://attack.mitre.org/techniques/T1136.001/ T1136.001], 
+[https://attack.mitre.org/techniques/T1136/ T1136]
 |
-Local Account
+Local Account, 
+Create Account
 |
+Persistence, 
 Persistence
 
 | TTP
@@ -10401,10 +11924,13 @@ Persistence
 | [[Documentation:ESSOC:detections:Detections#Detect_outbound_smb_traffic|Detect Outbound SMB Traffic]]
 
 |
-[https://attack.mitre.org/techniques/T1071.002/ T1071.002]
+[https://attack.mitre.org/techniques/T1071.002/ T1071.002], 
+[https://attack.mitre.org/techniques/T1071/ T1071]
 |
-File Transfer Protocols
+File Transfer Protocols, 
+Application Layer Protocol
 |
+Command And Control, 
 Command And Control
 
 | TTP
@@ -10412,10 +11938,13 @@ Command And Control
 | [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
 
 |
+[https://attack.mitre.org/techniques/T1021/ T1021], 
 [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
 |
+Remote Services, 
 SMB/Windows Admin Shares
 |
+Lateral Movement, 
 Lateral Movement
 
 | TTP
@@ -10423,10 +11952,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
 
 |
+[https://attack.mitre.org/techniques/T1569/ T1569], 
 [https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
+System Services, 
 Service Execution
 |
+Execution, 
 Execution
 
 | Hunting
@@ -10434,10 +11966,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_execution_policy_bypass|Malicious PowerShell Process - Execution Policy Bypass]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
+Command and Scripting Interpreter, 
 PowerShell
 |
+Execution, 
 Execution
 
 | TTP
@@ -10445,10 +11980,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]
 
 |
-[https://attack.mitre.org/techniques/T1562.004/ T1562.004]
+[https://attack.mitre.org/techniques/T1562.004/ T1562.004], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify System Firewall
+Disable or Modify System Firewall, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -10456,10 +11994,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Registry Run Keys / Startup Folder
+Registry Run Keys / Startup Folder, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -10467,10 +12008,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]
 
 |
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-SMB/Windows Admin Shares
+SMB/Windows Admin Shares, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -10478,10 +12022,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]
 
 |
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-SMB/Windows Admin Shares
+SMB/Windows Admin Shares, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -10489,10 +12036,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
 
 |
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
+[https://attack.mitre.org/techniques/T1543/ T1543]
 |
-Windows Service
+Windows Service, 
+Create or Modify System Process
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -10500,10 +12050,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Scheduled_task_deleted_or_created_via_cmd|Scheduled Task Deleted Or Created via CMD]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -10511,10 +12064,13 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Single_letter_process_on_endpoint|Single Letter Process On Endpoint]]
 
 |
+[https://attack.mitre.org/techniques/T1204/ T1204], 
 [https://attack.mitre.org/techniques/T1204.002/ T1204.002]
 |
+User Execution, 
 Malicious File
 |
+Execution, 
 Execution
 
 | TTP
@@ -10579,10 +12135,13 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Attempted_credential_dump_from_registry_via_reg_exe|Attempted Credential Dump From Registry via Reg exe]]
 
 |
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002]
+[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-Security Account Manager
+Security Account Manager, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -10604,10 +12163,13 @@ Command And Control
 | [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.003/ T1218.003]
 |
+Signed Binary Proxy Execution, 
 CMSTP
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -10659,10 +12221,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-LSASS Memory
+LSASS Memory, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -10670,10 +12235,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
 
 |
+[https://attack.mitre.org/techniques/T1021/ T1021], 
 [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
 |
+Remote Services, 
 SMB/Windows Admin Shares
 |
+Lateral Movement, 
 Lateral Movement
 
 | TTP
@@ -10692,10 +12260,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
 
 |
+[https://attack.mitre.org/techniques/T1569/ T1569], 
 [https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
+System Services, 
 Service Execution
 |
+Execution, 
 Execution
 
 | Hunting
@@ -10714,10 +12285,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Extraction_of_registry_hives|Extraction of Registry Hives]]
 
 |
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002]
+[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
-Security Account Manager
+Security Account Manager, 
+OS Credential Dumping
 |
+Credential Access, 
 Credential Access
 
 | TTP
@@ -10736,10 +12310,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Slui_runas_elevated|SLUI RunAs Elevated]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -10747,10 +12324,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Slui_spawning_a_process|SLUI Spawning a Process]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -10893,10 +12473,13 @@ Detect rarely used executables, specific registry paths that may confer malware
 | [[Documentation:ESSOC:detections:Detections#Detect_use_of_cmd_exe_to_launch_script_interpreters|Detect Use of cmd exe to Launch Script Interpreters]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
+Command and Scripting Interpreter, 
 Windows Command Shell
 |
+Execution, 
 Execution
 
 | TTP
@@ -10923,10 +12506,13 @@ Execution, Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Registry Run Keys / Startup Folder
+Registry Run Keys / Startup Folder, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -10934,10 +12520,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]
 
 |
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-SMB/Windows Admin Shares
+SMB/Windows Admin Shares, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -10945,10 +12534,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]
 
 |
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-SMB/Windows Admin Shares
+SMB/Windows Admin Shares, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -10956,10 +12548,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Suspicious_email_attachment_extensions|Suspicious Email Attachment Extensions]]
 
 |
-[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
+[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
+[https://attack.mitre.org/techniques/T1566/ T1566]
 |
-Spearphishing Attachment
+Spearphishing Attachment, 
+Phishing
 |
+Initial Access, 
 Initial Access
 
 | Anomaly
@@ -11026,10 +12621,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Cmdline_tool_not_executed_in_cmd_shell|Cmdline Tool Not Executed In CMD Shell]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.007/ T1059.007]
 |
+Command and Scripting Interpreter, 
 JavaScript
 |
+Execution, 
 Execution
 
 | TTP
@@ -11037,10 +12635,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Jscript_execution_using_cscript_app|Jscript Execution Using Cscript App]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.007/ T1059.007]
 |
+Command and Scripting Interpreter, 
 JavaScript
 |
+Execution, 
 Execution
 
 | TTP
@@ -11048,10 +12649,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Ms_scripting_process_loading_ldap_module|MS Scripting Process Loading Ldap Module]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.007/ T1059.007]
 |
+Command and Scripting Interpreter, 
 JavaScript
 |
+Execution, 
 Execution
 
 | Anomaly
@@ -11059,10 +12663,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Ms_scripting_process_loading_wmi_module|MS Scripting Process Loading WMI Module]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.007/ T1059.007]
 |
+Command and Scripting Interpreter, 
 JavaScript
 |
+Execution, 
 Execution
 
 | Anomaly
@@ -11070,10 +12677,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Non_chrome_process_accessing_chrome_default_dir|Non Chrome Process Accessing Chrome Default Dir]]
 
 |
+[https://attack.mitre.org/techniques/T1555/ T1555], 
 [https://attack.mitre.org/techniques/T1555.003/ T1555.003]
 |
+Credentials from Password Stores, 
 Credentials from Web Browsers
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -11081,10 +12691,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Non_firefox_process_access_firefox_profile_dir|Non Firefox Process Access Firefox Profile Dir]]
 
 |
+[https://attack.mitre.org/techniques/T1555/ T1555], 
 [https://attack.mitre.org/techniques/T1555.003/ T1555.003]
 |
+Credentials from Password Stores, 
 Credentials from Web Browsers
 |
+Credential Access, 
 Credential Access
 
 | Anomaly
@@ -11092,10 +12705,13 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Office_application_drop_executable|Office Application Drop Executable]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -11103,12 +12719,49 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_product_spawning_wmic|Office Product Spawning Wmic]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Vbscript_execution_using_wscript_app|Vbscript Execution Using Wscript App]]
+
+|
+[https://attack.mitre.org/techniques/T1059.005/ T1059.005], 
+[https://attack.mitre.org/techniques/T1059/ T1059]
+|
+Visual Basic, 
+Command and Scripting Interpreter
+|
+Execution, 
+Execution
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Wscript_or_cscript_suspicious_child_process|Wscript Or Cscript Suspicious Child Process]]
+
+|
+[https://attack.mitre.org/techniques/T1055/ T1055], 
+[https://attack.mitre.org/techniques/T1543/ T1543], 
+[https://attack.mitre.org/techniques/T1134.004/ T1134.004], 
+[https://attack.mitre.org/techniques/T1134/ T1134]
+|
+Process Injection, 
+Create or Modify System Process, 
+Parent PID Spoofing, 
+Access Token Manipulation
+|
+Defense Evasion, Privilege Escalation, 
+Persistence, Privilege Escalation, 
+Defense Evasion, Privilege Escalation, 
+Defense Evasion, Privilege Escalation
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Xsl_script_execution_with_wmic|XSL Script Execution With WMIC]]
@@ -11165,10 +12818,13 @@ Monitor for and investigate activities, including the creation or deletion of hi
 | [[Documentation:ESSOC:detections:Detections#Create_or_delete_windows_shares_using_net_exe|Create or delete windows shares using net exe]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.005/ T1070.005]
 |
+Indicator Removal on Host, 
 Network Share Connection Removal
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11176,10 +12832,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]
 
 |
-[https://attack.mitre.org/techniques/T1071.004/ T1071.004]
+[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
+[https://attack.mitre.org/techniques/T1071/ T1071]
 |
-DNS
+DNS, 
+Application Layer Protocol
 |
+Command And Control, 
 Command And Control
 
 | Anomaly
@@ -11187,10 +12846,13 @@ Command And Control
 | [[Documentation:ESSOC:detections:Detections#Dns_query_length_with_high_standard_deviation|DNS Query Length With High Standard Deviation]]
 
 |
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003]
+[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
+Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
+Exfiltration Over Alternative Protocol
 |
+Exfiltration, 
 Exfiltration
 
 | Anomaly
@@ -11198,10 +12860,13 @@ Exfiltration
 | [[Documentation:ESSOC:detections:Detections#Detect_outbound_smb_traffic|Detect Outbound SMB Traffic]]
 
 |
-[https://attack.mitre.org/techniques/T1071.002/ T1071.002]
+[https://attack.mitre.org/techniques/T1071.002/ T1071.002], 
+[https://attack.mitre.org/techniques/T1071/ T1071]
 |
-File Transfer Protocols
+File Transfer Protocols, 
+Application Layer Protocol
 |
+Command And Control, 
 Command And Control
 
 | TTP
@@ -11209,10 +12874,13 @@ Command And Control
 | [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
 
 |
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001]
+[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-Remote Desktop Protocol
+Remote Desktop Protocol, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -11220,10 +12888,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Remote_desktop_process_running_on_system|Remote Desktop Process Running On System]]
 
 |
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001]
+[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-Remote Desktop Protocol
+Remote Desktop Protocol, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Hunting
@@ -11231,10 +12902,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]
 
 |
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-SMB/Windows Admin Shares
+SMB/Windows Admin Shares, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -11242,10 +12916,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]
 
 |
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-SMB/Windows Admin Shares
+SMB/Windows Admin Shares, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -11293,10 +12970,13 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Account_discovery_with_net_app|Account Discovery With Net App]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -11326,10 +13006,13 @@ Defense Evasion, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Drop_icedid_license_dat|Drop IcedID License dat]]
 
 |
+[https://attack.mitre.org/techniques/T1204/ T1204], 
 [https://attack.mitre.org/techniques/T1204.002/ T1204.002]
 |
+User Execution, 
 Malicious File
 |
+Execution, 
 Execution
 
 | Hunting
@@ -11337,10 +13020,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Eventvwr_uac_bypass|Eventvwr UAC Bypass]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -11349,12 +13035,15 @@ Privilege Escalation, Defense Evasion
 
 |
 [https://attack.mitre.org/techniques/T1112/ T1112], 
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
 Modify Registry, 
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
 Defense Evasion, 
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -11362,10 +13051,13 @@ Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Icedid_exfiltrated_archived_file_creation|IcedID Exfiltrated Archived File Creation]]
 
 |
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001]
+[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
+[https://attack.mitre.org/techniques/T1560/ T1560]
 |
-Archive via Utility
+Archive via Utility, 
+Archive Collected Data
 |
+Collection, 
 Collection
 
 | Hunting
@@ -11373,10 +13065,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Mshta_spawning_rundll32_or_regsvr32_process|Mshta spawning Rundll32 OR Regsvr32 Process]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.005/ T1218.005]
 |
+Signed Binary Proxy Execution, 
 Mshta
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11395,10 +13090,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Office_application_spawn_regsvr32_process|Office Application Spawn Regsvr32 process]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -11406,10 +13104,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -11417,10 +13118,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -11428,10 +13132,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_product_spawning_mshta|Office Product Spawning MSHTA]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -11439,10 +13146,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Registry Run Keys / Startup Folder
+Registry Run Keys / Startup Folder, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -11472,10 +13182,13 @@ Defense Evasion, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Rundll32_dnsquery|Rundll32 DNSQuery]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11483,10 +13196,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Rundll32_process_creating_exe_dll_files|Rundll32 Process Creating Exe Dll Files]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11516,10 +13232,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Suspicious_icedid_regsvr32_cmdline|Suspicious IcedID Regsvr32 Cmdline]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.010/ T1218.010]
 |
+Signed Binary Proxy Execution, 
 Regsvr32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11527,10 +13246,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_icedid_rundll32_cmdline|Suspicious IcedID Rundll32 Cmdline]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11538,10 +13260,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_plugininit|Suspicious Rundll32 PluginInit]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11549,10 +13274,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -11604,10 +13332,13 @@ Detect activities and various techniques associated with the Orangeworm Attack G
 | [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]
 
 |
+[https://attack.mitre.org/techniques/T1569/ T1569], 
 [https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
+System Services, 
 Service Execution
 |
+Execution, 
 Execution
 
 | Anomaly
@@ -11615,10 +13346,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
 
 |
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
+[https://attack.mitre.org/techniques/T1543/ T1543]
 |
-Windows Service
+Windows Service, 
+Create or Modify System Process
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -11666,10 +13400,13 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#7zip_commandline_to_smb_share_path|7zip CommandLine To SMB Share Path]]
 
 |
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001]
+[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
+[https://attack.mitre.org/techniques/T1560/ T1560]
 |
-Archive via Utility
+Archive via Utility, 
+Archive Collected Data
 |
+Collection, 
 Collection
 
 | Hunting
@@ -11677,10 +13414,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Allow_file_and_printing_sharing_in_firewall|Allow File And Printing Sharing In Firewall]]
 
 |
-[https://attack.mitre.org/techniques/T1562.007/ T1562.007]
+[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Cloud Firewall
+Disable or Modify Cloud Firewall, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11688,10 +13428,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]
 
 |
-[https://attack.mitre.org/techniques/T1562.007/ T1562.007]
+[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Cloud Firewall
+Disable or Modify Cloud Firewall, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11743,10 +13486,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.003/ T1218.003]
 |
+Signed Binary Proxy Execution, 
 CMSTP
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11754,10 +13500,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Clear_unallocated_sector_using_cipher_app|Clear Unallocated Sector Using Cipher App]]
 
 |
-[https://attack.mitre.org/techniques/T1070.004/ T1070.004]
+[https://attack.mitre.org/techniques/T1070.004/ T1070.004], 
+[https://attack.mitre.org/techniques/T1070/ T1070]
 |
-File Deletion
+File Deletion, 
+Indicator Removal on Host
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11854,21 +13603,27 @@ Exfiltration
 
 |
 [https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
-[https://attack.mitre.org/techniques/T1087.001/ T1087.001], 
+[https://attack.mitre.org/techniques/T1069.001/ T1069.001], 
 [https://attack.mitre.org/techniques/T1482/ T1482], 
+[https://attack.mitre.org/techniques/T1087.001/ T1087.001], 
+[https://attack.mitre.org/techniques/T1087/ T1087], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002], 
-[https://attack.mitre.org/techniques/T1069.001/ T1069.001]
+[https://attack.mitre.org/techniques/T1069/ T1069]
 |
 Domain Account, 
-Local Account, 
+Local Groups, 
 Domain Trust Discovery, 
+Local Account, 
+Account Discovery, 
 Domain Groups, 
-Local Groups
+Permission Groups Discovery
 |
 Discovery, 
 Discovery, 
 Discovery, 
 Discovery, 
+Discovery, 
+Discovery, 
 Discovery
 
 | TTP
@@ -11877,21 +13632,27 @@ Discovery
 
 |
 [https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
-[https://attack.mitre.org/techniques/T1087.001/ T1087.001], 
+[https://attack.mitre.org/techniques/T1069.001/ T1069.001], 
 [https://attack.mitre.org/techniques/T1482/ T1482], 
+[https://attack.mitre.org/techniques/T1087.001/ T1087.001], 
+[https://attack.mitre.org/techniques/T1087/ T1087], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002], 
-[https://attack.mitre.org/techniques/T1069.001/ T1069.001]
+[https://attack.mitre.org/techniques/T1069/ T1069]
 |
 Domain Account, 
-Local Account, 
+Local Groups, 
 Domain Trust Discovery, 
+Local Account, 
+Account Discovery, 
 Domain Groups, 
-Local Groups
+Permission Groups Discovery
 |
 Discovery, 
 Discovery, 
 Discovery, 
 Discovery, 
+Discovery, 
+Discovery, 
 Discovery
 
 | TTP
@@ -11900,21 +13661,27 @@ Discovery
 
 |
 [https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
-[https://attack.mitre.org/techniques/T1087.001/ T1087.001], 
+[https://attack.mitre.org/techniques/T1069.001/ T1069.001], 
 [https://attack.mitre.org/techniques/T1482/ T1482], 
+[https://attack.mitre.org/techniques/T1087.001/ T1087.001], 
+[https://attack.mitre.org/techniques/T1087/ T1087], 
 [https://attack.mitre.org/techniques/T1069.002/ T1069.002], 
-[https://attack.mitre.org/techniques/T1069.001/ T1069.001]
+[https://attack.mitre.org/techniques/T1069/ T1069]
 |
 Domain Account, 
-Local Account, 
+Local Groups, 
 Domain Trust Discovery, 
+Local Account, 
+Account Discovery, 
 Domain Groups, 
-Local Groups
+Permission Groups Discovery
 |
 Discovery, 
 Discovery, 
 Discovery, 
 Discovery, 
+Discovery, 
+Discovery, 
 Discovery
 
 | TTP
@@ -11922,10 +13689,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Disable_amsi_through_registry|Disable AMSI Through Registry]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11933,10 +13703,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disable_etw_through_registry|Disable ETW Through Registry]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11944,10 +13717,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disable_logs_using_wevtutil|Disable Logs Using WevtUtil]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11966,10 +13742,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -11999,10 +13778,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_sc_service_utility|Excessive Usage Of SC Service Utility]]
 
 |
+[https://attack.mitre.org/techniques/T1569/ T1569], 
 [https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
+System Services, 
 Service Execution
 |
+Execution, 
 Execution
 
 | Anomaly
@@ -12010,10 +13792,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Execute_javascript_with_jscript_com_clsid|Execute Javascript With Jscript COM CLSID]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.005/ T1059.005]
 |
+Command and Scripting Interpreter, 
 Visual Basic
 |
+Execution, 
 Execution
 
 | TTP
@@ -12065,10 +13850,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Msmpeng_application_dll_side_loading|Msmpeng Application DLL Side Loading]]
 
 |
-[https://attack.mitre.org/techniques/T1574.002/ T1574.002]
+[https://attack.mitre.org/techniques/T1574.002/ T1574.002], 
+[https://attack.mitre.org/techniques/T1574/ T1574]
 |
-DLL Side-Loading
+DLL Side-Loading, 
+Hijack Execution Flow
 |
+Persistence, Privilege Escalation, Defense Evasion, 
 Persistence, Privilege Escalation, Defense Evasion
 
 | TTP
@@ -12087,10 +13875,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Powershell_disable_security_monitoring|Powershell Disable Security Monitoring]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12098,10 +13889,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Powershell_enable_smb1protocol_feature|Powershell Enable SMB1Protocol Feature]]
 
 |
+[https://attack.mitre.org/techniques/T1027/ T1027], 
 [https://attack.mitre.org/techniques/T1027.005/ T1027.005]
 |
+Obfuscated Files or Information, 
 Indicator Removal from Tools
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12109,10 +13903,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Powershell_execute_com_object|Powershell Execute COM Object]]
 
 |
-[https://attack.mitre.org/techniques/T1546.015/ T1546.015]
+[https://attack.mitre.org/techniques/T1546.015/ T1546.015], 
+[https://attack.mitre.org/techniques/T1546/ T1546]
 |
-Component Object Model Hijacking
+Component Object Model Hijacking, 
+Event Triggered Execution
 |
+Privilege Escalation, Persistence, 
 Privilege Escalation, Persistence
 
 | TTP
@@ -12153,10 +13950,13 @@ Reconnaissance
 | [[Documentation:ESSOC:detections:Detections#Recursive_delete_of_directory_in_batch_cmd|Recursive Delete of Directory In Batch CMD]]
 
 |
-[https://attack.mitre.org/techniques/T1070.004/ T1070.004]
+[https://attack.mitre.org/techniques/T1070.004/ T1070.004], 
+[https://attack.mitre.org/techniques/T1070/ T1070]
 |
-File Deletion
+File Deletion, 
+Indicator Removal on Host
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12164,10 +13964,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Registry Run Keys / Startup Folder
+Registry Run Keys / Startup Folder, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -12219,10 +14022,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]
 
 |
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-SMB/Windows Admin Shares
+SMB/Windows Admin Shares, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -12230,10 +14036,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike_-_mltk|SMB Traffic Spike - MLTK]]
 
 |
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-SMB/Windows Admin Shares
+SMB/Windows Admin Shares, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -12241,10 +14050,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Schtasks_used_for_forcing_a_reboot|Schtasks used for forcing a reboot]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -12260,10 +14072,13 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Start_up_during_safe_mode_boot|Start Up During Safe Mode Boot]]
 
 |
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Registry Run Keys / Startup Folder
+Registry Run Keys / Startup Folder, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -12271,10 +14086,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12282,10 +14100,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Suspicious_scheduled_task_from_public_directory|Suspicious Scheduled Task from Public Directory]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | Anomaly
@@ -12293,10 +14114,13 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Suspicious_wevtutil_usage|Suspicious wevtutil Usage]]
 
 |
-[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
+[https://attack.mitre.org/techniques/T1070.001/ T1070.001], 
+[https://attack.mitre.org/techniques/T1070/ T1070]
 |
-Clear Windows Event Logs
+Clear Windows Event Logs, 
+Indicator Removal on Host
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12304,10 +14128,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]
 
 |
+[https://attack.mitre.org/techniques/T1036/ T1036], 
 [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
+Masquerading, 
 Rename System Utilities
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12315,10 +14142,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Tor_traffic|TOR Traffic]]
 
 |
+[https://attack.mitre.org/techniques/T1071/ T1071], 
 [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
 |
+Application Layer Protocol, 
 Web Protocols
 |
+Command And Control, 
 Command And Control
 
 | TTP
@@ -12326,10 +14156,13 @@ Command And Control
 | [[Documentation:ESSOC:detections:Detections#Uac_bypass_with_colorui_com_object|UAC Bypass With Colorui COM Object]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.003/ T1218.003]
 |
+Signed Binary Proxy Execution, 
 CMSTP
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12348,10 +14181,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Uninstall_app_using_msiexec|Uninstall App Using MsiExec]]
 
 |
-[https://attack.mitre.org/techniques/T1218.007/ T1218.007]
+[https://attack.mitre.org/techniques/T1218.007/ T1218.007], 
+[https://attack.mitre.org/techniques/T1218/ T1218]
 |
-Msiexec
+Msiexec, 
+Signed Binary Proxy Execution
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12386,10 +14222,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Wbemprox_com_object_execution|Wbemprox COM Object Execution]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.003/ T1218.003]
 |
+Signed Binary Proxy Execution, 
 CMSTP
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12397,10 +14236,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_clear_logs|WevtUtil Usage To Clear Logs]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12408,10 +14250,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Wevtutil_usage_to_disable_logs|Wevtutil Usage To Disable Logs]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12419,10 +14264,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -12430,10 +14278,13 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_to_spawn_shell|WinEvent Scheduled Task Created to Spawn Shell]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -12441,10 +14292,13 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Windows_event_log_cleared|Windows Event Log Cleared]]
 
 |
+[https://attack.mitre.org/techniques/T1070/ T1070], 
 [https://attack.mitre.org/techniques/T1070.001/ T1070.001]
 |
+Indicator Removal on Host, 
 Clear Windows Event Logs
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12562,10 +14416,13 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
+[https://attack.mitre.org/techniques/T1548/ T1548]
 |
-Bypass User Account Control
+Bypass User Account Control, 
+Abuse Elevation Control Mechanism
 |
+Privilege Escalation, Defense Evasion, 
 Privilege Escalation, Defense Evasion
 
 | TTP
@@ -12579,6 +14436,20 @@ Masquerading
 |
 Defense Evasion
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Malicious_inprocserver32_modification|Malicious InProcServer32 Modification]]
+
+|
+[https://attack.mitre.org/techniques/T1218.010/ T1218.010], 
+[https://attack.mitre.org/techniques/T1112/ T1112]
+|
+Regsvr32, 
+Modify Registry
+|
+Defense Evasion, 
+Defense Evasion
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Process_deleting_its_process_file_path|Process Deleting Its Process File Path]]
@@ -12592,13 +14463,30 @@ Defense Evasion
 
 | TTP
 |-
+| [[Documentation:ESSOC:detections:Detections#Process_writing_dynamicwrapperx|Process Writing DynamicWrapperX]]
+
+|
+[https://attack.mitre.org/techniques/T1059/ T1059], 
+[https://attack.mitre.org/techniques/T1559.001/ T1559.001]
+|
+Command and Scripting Interpreter, 
+Component Object Model
+|
+Execution, 
+Execution
+
+| Hunting
+|-
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
+[https://attack.mitre.org/techniques/T1547/ T1547]
 |
-Registry Run Keys / Startup Folder
+Registry Run Keys / Startup Folder, 
+Boot or Logon Autostart Execution
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -12656,6 +14544,51 @@ Screen Capture
 |
 Collection
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Vbscript_execution_using_wscript_app|Vbscript Execution Using Wscript App]]
+
+|
+[https://attack.mitre.org/techniques/T1059.005/ T1059.005], 
+[https://attack.mitre.org/techniques/T1059/ T1059]
+|
+Visual Basic, 
+Command and Scripting Interpreter
+|
+Execution, 
+Execution
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Winhlp32_spawning_a_process|Winhlp32 Spawning a Process]]
+
+|
+[https://attack.mitre.org/techniques/T1055/ T1055]
+|
+Process Injection
+|
+Defense Evasion, Privilege Escalation
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Wscript_or_cscript_suspicious_child_process|Wscript Or Cscript Suspicious Child Process]]
+
+|
+[https://attack.mitre.org/techniques/T1055/ T1055], 
+[https://attack.mitre.org/techniques/T1543/ T1543], 
+[https://attack.mitre.org/techniques/T1134.004/ T1134.004], 
+[https://attack.mitre.org/techniques/T1134/ T1134]
+|
+Process Injection, 
+Create or Modify System Process, 
+Parent PID Spoofing, 
+Access Token Manipulation
+|
+Defense Evasion, Privilege Escalation, 
+Persistence, Privilege Escalation, 
+Defense Evasion, Privilege Escalation, 
+Defense Evasion, Privilege Escalation
+
 | TTP
 |}
 
@@ -12703,10 +14636,13 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]
 
 |
-[https://attack.mitre.org/techniques/T1562.007/ T1562.007]
+[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Cloud Firewall
+Disable or Modify Cloud Firewall, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12725,10 +14661,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12747,10 +14686,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Msmpeng_application_dll_side_loading|Msmpeng Application DLL Side Loading]]
 
 |
-[https://attack.mitre.org/techniques/T1574.002/ T1574.002]
+[https://attack.mitre.org/techniques/T1574.002/ T1574.002], 
+[https://attack.mitre.org/techniques/T1574/ T1574]
 |
-DLL Side-Loading
+DLL Side-Loading, 
+Hijack Execution Flow
 |
+Persistence, Privilege Escalation, Defense Evasion, 
 Persistence, Privilege Escalation, Defense Evasion
 
 | TTP
@@ -12758,10 +14700,13 @@ Persistence, Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Powershell_disable_security_monitoring|Powershell Disable Security Monitoring]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12791,10 +14736,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Wbemprox_com_object_execution|Wbemprox COM Object Execution]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.003/ T1218.003]
 |
+Signed Binary Proxy Execution, 
 CMSTP
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -12884,10 +14832,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_bruteforce|Remote Desktop Network Bruteforce]]
 
 |
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001]
+[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-Remote Desktop Protocol
+Remote Desktop Protocol, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | TTP
@@ -12895,10 +14846,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
 
 |
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001]
+[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-Remote Desktop Protocol
+Remote Desktop Protocol, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -12917,10 +14871,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Ryuk_wake_on_lan_command|Ryuk Wake on LAN Command]]
 
 |
+[https://attack.mitre.org/techniques/T1059/ T1059], 
 [https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
+Command and Scripting Interpreter, 
 Windows Command Shell
 |
+Execution, 
 Execution
 
 | TTP
@@ -12936,10 +14893,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Suspicious_scheduled_task_from_public_directory|Suspicious Scheduled Task from Public Directory]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | Anomaly
@@ -12958,10 +14918,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_within_public_path|WinEvent Scheduled Task Created Within Public Path]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -12969,10 +14932,13 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Winevent_scheduled_task_created_to_spawn_shell|WinEvent Scheduled Task Created to Spawn Shell]]
 
 |
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
+[https://attack.mitre.org/techniques/T1053/ T1053]
 |
-Scheduled Task
+Scheduled Task, 
+Scheduled Task/Job
 |
+Execution, Persistence, Privilege Escalation, 
 Execution, Persistence, Privilege Escalation
 
 | TTP
@@ -12980,10 +14946,13 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Windows_disableantispyware_registry|Windows DisableAntiSpyware Registry]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -13053,26 +15022,32 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 |
 [https://attack.mitre.org/techniques/T1036.005/ T1036.005], 
-[https://attack.mitre.org/techniques/T1595/ T1595], 
-[https://attack.mitre.org/techniques/T1003/ T1003]
+[https://attack.mitre.org/techniques/T1036/ T1036], 
+[https://attack.mitre.org/techniques/T1003/ T1003], 
+[https://attack.mitre.org/techniques/T1595/ T1595]
 |
 Match Legitimate Name or Location, 
-Active Scanning, 
-OS Credential Dumping
+Masquerading, 
+OS Credential Dumping, 
+Active Scanning
 |
 Defense Evasion, 
-Reconnaissance, 
-Credential Access
+Defense Evasion, 
+Credential Access, 
+Reconnaissance
 
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Batch_file_write_to_system32|Batch File Write to System32]]
 
 |
+[https://attack.mitre.org/techniques/T1204/ T1204], 
 [https://attack.mitre.org/techniques/T1204.002/ T1204.002]
 |
+User Execution, 
 Malicious File
 |
+Execution, 
 Execution
 
 | TTP
@@ -13113,10 +15088,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
 
 |
+[https://attack.mitre.org/techniques/T1021/ T1021], 
 [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
 |
+Remote Services, 
 SMB/Windows Admin Shares
 |
+Lateral Movement, 
 Lateral Movement
 
 | TTP
@@ -13124,10 +15102,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
 
 |
+[https://attack.mitre.org/techniques/T1569/ T1569], 
 [https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
+System Services, 
 Service Execution
 |
+Execution, 
 Execution
 
 | Hunting
@@ -13162,10 +15143,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_bruteforce|Remote Desktop Network Bruteforce]]
 
 |
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001]
+[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-Remote Desktop Protocol
+Remote Desktop Protocol, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | TTP
@@ -13173,10 +15157,13 @@ Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
 
 |
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001]
+[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
+[https://attack.mitre.org/techniques/T1021/ T1021]
 |
-Remote Desktop Protocol
+Remote Desktop Protocol, 
+Remote Services
 |
+Lateral Movement, 
 Lateral Movement
 
 | Anomaly
@@ -13257,10 +15244,13 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Account_discovery_with_net_app|Account Discovery With Net App]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
+[https://attack.mitre.org/techniques/T1087/ T1087]
 |
-Domain Account
+Domain Account, 
+Account Discovery
 |
+Discovery, 
 Discovery
 
 | TTP
@@ -13268,10 +15258,13 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Attempt_to_stop_security_service|Attempt To Stop Security Service]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -13290,10 +15283,13 @@ Defense Evasion, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Mshta_spawning_rundll32_or_regsvr32_process|Mshta spawning Rundll32 OR Regsvr32 Process]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.005/ T1218.005]
 |
+Signed Binary Proxy Execution, 
 Mshta
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -13301,10 +15297,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -13312,10 +15311,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]
 
 |
+[https://attack.mitre.org/techniques/T1566/ T1566], 
 [https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
+Phishing, 
 Spearphishing Attachment
 |
+Initial Access, 
 Initial Access
 
 | TTP
@@ -13323,10 +15325,13 @@ Initial Access
 | [[Documentation:ESSOC:detections:Detections#Office_product_spawn_cmd_process|Office Product Spawn CMD Process]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.005/ T1218.005]
 |
+Signed Binary Proxy Execution, 
 Mshta
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -13356,10 +15361,13 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_startw|Suspicious Rundll32 StartW]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -13378,10 +15386,13 @@ Defense Evasion, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Wermgr_process_connecting_to_ip_check_web_services|Wermgr Process Connecting To IP Check Web Services]]
 
 |
+[https://attack.mitre.org/techniques/T1590/ T1590], 
 [https://attack.mitre.org/techniques/T1590.005/ T1590.005]
 |
+Gather Victim Network Information, 
 IP Addresses
 |
+Reconnaissance, 
 Reconnaissance
 
 | TTP
@@ -13411,10 +15422,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Write_executable_in_smb_share|Write Executable in SMB Share]]
 
 |
+[https://attack.mitre.org/techniques/T1021/ T1021], 
 [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
 |
+Remote Services, 
 SMB/Windows Admin Shares
 |
+Lateral Movement, 
 Lateral Movement
 
 | TTP
@@ -13469,16 +15483,19 @@ Quickly identify systems running new or unusual processes in your environment th
 
 |
 [https://attack.mitre.org/techniques/T1036.005/ T1036.005], 
-[https://attack.mitre.org/techniques/T1595/ T1595], 
-[https://attack.mitre.org/techniques/T1003/ T1003]
+[https://attack.mitre.org/techniques/T1036/ T1036], 
+[https://attack.mitre.org/techniques/T1003/ T1003], 
+[https://attack.mitre.org/techniques/T1595/ T1595]
 |
 Match Legitimate Name or Location, 
-Active Scanning, 
-OS Credential Dumping
+Masquerading, 
+OS Credential Dumping, 
+Active Scanning
 |
 Defense Evasion, 
-Reconnaissance, 
-Credential Access
+Defense Evasion, 
+Credential Access, 
+Reconnaissance
 
 | TTP
 |-
@@ -13610,10 +15627,38 @@ Execution, Lateral Movement
 | [[Documentation:ESSOC:detections:Detections#Rundll_loading_dll_by_ordinal|RunDLL Loading DLL By Ordinal]]
 
 |
+[https://attack.mitre.org/techniques/T1218/ T1218], 
 [https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
+Signed Binary Proxy Execution, 
 Rundll32
 |
+Defense Evasion, 
+Defense Evasion
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Rundll32_shimcache_flush|Rundll32 Shimcache Flush]]
+
+|
+[https://attack.mitre.org/techniques/T1112/ T1112]
+|
+Modify Registry
+|
+Defense Evasion
+
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Suspicious_copy_on_system32|Suspicious Copy on System32]]
+
+|
+[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
+[https://attack.mitre.org/techniques/T1036/ T1036]
+|
+Rename System Utilities, 
+Masquerading
+|
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -13621,10 +15666,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]
 
 |
+[https://attack.mitre.org/techniques/T1036/ T1036], 
 [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
+Masquerading, 
 Rename System Utilities
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -13653,6 +15701,20 @@ Defense Evasion
 
 | Anomaly
 |-
+| [[Documentation:ESSOC:detections:Detections#Verclsid_clsid_execution|Verclsid CLSID Execution]]
+
+|
+[https://attack.mitre.org/techniques/T1218.012/ T1218.012], 
+[https://attack.mitre.org/techniques/T1218/ T1218]
+|
+Verclsid, 
+Signed Binary Proxy Execution
+|
+Defense Evasion, 
+Defense Evasion
+
+| Hunting
+|-
 | [[Documentation:ESSOC:detections:Detections#Winrm_spawning_a_process|WinRM Spawning a Process]]
 
 |
@@ -13662,6 +15724,26 @@ Exploit Public-Facing Application
 |
 Initial Access
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Wscript_or_cscript_suspicious_child_process|Wscript Or Cscript Suspicious Child Process]]
+
+|
+[https://attack.mitre.org/techniques/T1055/ T1055], 
+[https://attack.mitre.org/techniques/T1543/ T1543], 
+[https://attack.mitre.org/techniques/T1134.004/ T1134.004], 
+[https://attack.mitre.org/techniques/T1134/ T1134]
+|
+Process Injection, 
+Create or Modify System Process, 
+Parent PID Spoofing, 
+Access Token Manipulation
+|
+Defense Evasion, Privilege Escalation, 
+Persistence, Privilege Escalation, 
+Defense Evasion, Privilege Escalation, 
+Defense Evasion, Privilege Escalation
+
 | TTP
 |}
 
@@ -13717,10 +15799,13 @@ Detect and investigate suspected abuse of file extensions and Windows file assoc
 | [[Documentation:ESSOC:detections:Detections#Execution_of_file_with_multiple_extensions|Execution of File with Multiple Extensions]]
 
 |
+[https://attack.mitre.org/techniques/T1036/ T1036], 
 [https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
+Masquerading, 
 Rename System Utilities
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -13766,10 +15851,13 @@ Windows services are often used by attackers for persistence and the ability to
 | [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]
 
 |
+[https://attack.mitre.org/techniques/T1569/ T1569], 
 [https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
+System Services, 
 Service Execution
 |
+Execution, 
 Execution
 
 | Anomaly
@@ -13811,10 +15899,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Reg_exe_manipulating_windows_services_registry_keys|Reg exe Manipulating Windows Services Registry Keys]]
 
 |
-[https://attack.mitre.org/techniques/T1574.011/ T1574.011]
+[https://attack.mitre.org/techniques/T1574.011/ T1574.011], 
+[https://attack.mitre.org/techniques/T1574/ T1574]
 |
-Services Registry Permissions Weakness
+Services Registry Permissions Weakness, 
+Hijack Execution Flow
 |
+Persistence, Privilege Escalation, Defense Evasion, 
 Persistence, Privilege Escalation, Defense Evasion
 
 | TTP
@@ -13822,10 +15913,13 @@ Persistence, Privilege Escalation, Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
 
 |
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
+[https://attack.mitre.org/techniques/T1543/ T1543]
 |
-Windows Service
+Windows Service, 
+Create or Modify System Process
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -13874,16 +15968,19 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 |
 [https://attack.mitre.org/techniques/T1036.005/ T1036.005], 
-[https://attack.mitre.org/techniques/T1595/ T1595], 
-[https://attack.mitre.org/techniques/T1003/ T1003]
+[https://attack.mitre.org/techniques/T1036/ T1036], 
+[https://attack.mitre.org/techniques/T1003/ T1003], 
+[https://attack.mitre.org/techniques/T1595/ T1595]
 |
 Match Legitimate Name or Location, 
-Active Scanning, 
-OS Credential Dumping
+Masquerading, 
+OS Credential Dumping, 
+Active Scanning
 |
 Defense Evasion, 
-Reconnaissance, 
-Credential Access
+Defense Evasion, 
+Credential Access, 
+Reconnaissance
 
 | TTP
 |-
@@ -13956,10 +16053,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Disable_windows_app_hotkeys|Disable Windows App Hotkeys]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -14044,10 +16144,13 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_taskkill|Excessive Usage Of Taskkill]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | Anomaly
@@ -14077,10 +16180,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Hide_user_account_from_sign-in_screen|Hide User Account From Sign-In Screen]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -14132,10 +16238,13 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Process_kill_base_on_file_path|Process Kill Base On File Path]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
+[https://attack.mitre.org/techniques/T1562/ T1562]
 |
-Disable or Modify Tools
+Disable or Modify Tools, 
+Impair Defenses
 |
+Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -14154,10 +16263,13 @@ Execution, Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Suspicious_driver_loaded_path|Suspicious Driver Loaded Path]]
 
 |
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
+[https://attack.mitre.org/techniques/T1543/ T1543]
 |
-Windows Service
+Windows Service, 
+Create or Modify System Process
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -14176,10 +16288,13 @@ Persistence, Privilege Escalation
 | [[Documentation:ESSOC:detections:Detections#Xmrig_driver_loaded|XMRIG Driver Loaded]]
 
 |
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
+[https://attack.mitre.org/techniques/T1543/ T1543]
 |
-Windows Service
+Windows Service, 
+Create or Modify System Process
 |
+Persistence, Privilege Escalation, 
 Persistence, Privilege Escalation
 
 | TTP
@@ -14348,7 +16463,7 @@ Discovery
 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-10-14 15:40:37.356079 UTC
+# On Date: 2021-10-27 10:32:04.194821 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/requirements.txt b/requirements.txt
index 4b2d778ad7..afb97b4103 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -26,10 +26,10 @@ importlib-metadata==4.8.1
 importlib-resources==5.2.2
 ipaddr==2.2.0
 Jinja2==3.0.1
-jsonschema==4.0.1
+jsonschema==3.2.0
 lockfile==0.12.2
 MarkupSafe==2.0.1
-more-itertools==8.9.0
+more-itertools==8.8.0
 msgpack==1.0.2
 nodeenv==1.6.0
 packaging==21.0
@@ -38,9 +38,10 @@ pendulum==2.1.2
 pep517==0.11.0
 Pillow==8.3.2
 platformdirs==2.3.0
-pre-commit==2.15.0
+pre-commit==2.14.1
 progress==1.6
 prompt-toolkit==1.0.14
+pycvesearch==1.0.1
 pyfiglet==0.8.post1
 Pygments==2.10.0
 PyInquirer==1.0.3
@@ -68,8 +69,8 @@ toml==0.10.2
 tomli==1.2.1
 typing==3.7.4.3
 tzlocal==3.0
-urllib3==1.26.7
+urllib3==1.26.6
 virtualenv==20.7.2
 wcwidth==0.2.5
 webencodings==0.5.1
-zipp==3.5.0
\ No newline at end of file
+zipp==3.5.0