diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index d9ac7d0dab..c9b92d1abe 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -83,7 +83,8 @@ class ObjToYmlAdapter(Adapter): "risk_score": True, "security_domain": True, "required_fields": True, - "research_site_url": True + "research_site_url": True, + "event_schema": True }, "test": { diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index 74e9389910..149293ea33 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -96,6 +96,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index e925a3b528..f3be46a3e3 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -100,6 +100,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/a0c8c292-d01a-11eb-aa18-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index dfe2c5499b..c29bc344d5 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -97,6 +97,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/afb31de4-d023-11eb-98d5-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index b35951efc0..824d57f7cf 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -97,6 +97,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 3be578de8b..4761737ef8 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -92,6 +92,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 099d38b790..a392a6c03c 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -93,6 +93,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/8f907d90-6173-11ec-9c23-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index aff05021cb..e77eb25820 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -96,6 +96,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/8776d79c-d26e-11eb-9a56-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index ba7ea269ef..e7e25913f4 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -95,6 +95,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/b76eae28-cd25-11eb-9c92-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 6d37633619..d17dc63952 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -99,6 +99,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd80-4ffa-a844-25026e0a0c94/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index a1afee30c5..c425f8be7b 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -105,6 +105,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/e8b74268-5454-11ec-a799-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index 5362d01bc4..2c0727e6ea 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -99,6 +99,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/ba858b08-d26c-11eb-af9b-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index d6c96178f1..18b26f4280 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -100,6 +100,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/2452e632-9e0d-11eb-34ba-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index 94f2e83b63..c95989ea47 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -95,6 +95,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/f792cdc9-43ee-4429-a3c0-ffce4fed1a85/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index 9acee5e448..1a8a7f3812 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -95,6 +95,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/c6da561a-cd29-11eb-ae65-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index 379aa5d829..3171f9be4e 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -98,6 +98,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/028e4406-6176-11ec-aec2-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index 1e3b341f99..7aa6d2ed6f 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -97,6 +97,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/9ae9a48a-cdbe-11eb-875a-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index 00e479fddd..2924e9bd1d 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -98,6 +98,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/3ea3851a-8736-41a0-bc09-7e4485b48fa6/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index 21592d7a3c..fc82f60ccb 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -96,6 +96,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/dbc30554-d27e-11eb-9e5e-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index 5a6df2023c..8d7c59f3e8 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -109,6 +109,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 217b6d54ee..9872f83dd7 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -302,6 +302,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/28179107-099a-464a-94d3-08301e6c055f/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 77a091f15d..47846528df 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -94,6 +94,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/71efbf52-4dbb-4c00-a520-306aa546cbb7/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index 106db2ab5c..72db868964 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -101,6 +101,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/5438113c-cdd9-11eb-93b8-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 89d6b0a1a8..7e6998c83b 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -97,6 +97,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/a4bdc944-cdd9-11eb-ac97-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index 45a197911a..24b99a2af3 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -105,6 +105,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/1e25e97a-8ea4-11ec-9767-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 984877da0c..b6bc06211c 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -111,6 +111,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/d76e8188-8f5a-11ec-ace4-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index 60120cdd15..516d6aa45b 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -103,6 +103,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/b06983f4-8f72-11ec-ab50-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index 2ef6460d58..a2aea0fb8b 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -100,6 +100,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/8cb1ad38-8f6d-11ec-87a3-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index 8e3e94e9b8..22394fedab 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -101,6 +101,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/9ac29c40-8f6b-11ec-b19a-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml index bc9fa447ef..f0fec8c882 100644 --- a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -100,6 +100,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/0ae05a0f-bc84-456b-822a-a5b9c081c7ca/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 98c521080e..b04796e87e 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -111,6 +111,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/cc8d046a-543b-11ec-b864-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 559356772f..b3c67e8cab 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -91,6 +91,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/c205bd2e-cd5b-4224-8510-578a2a1f83d7/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index 35544754d5..9ef79fe0b0 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -94,6 +94,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/aa502688-9037-11ec-842d-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index f95ba85c51..e62b33ab77 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -136,6 +136,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/21179107-099a-324a-94d3-08301e6c065f/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml index 1f4869baf2..435eff87a2 100644 --- a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml +++ b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml @@ -120,6 +120,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/1118bc65-b0c7-4589-bc2f-ad6802fd0909/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 5eae55871e..014fb72c46 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -103,6 +103,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/f253f9c2-10f0-4cc8-b469-f505ba8c2038/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index 33593d5f95..60a25fe727 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -96,6 +96,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/695bfad6-9662-4f9e-a576-bf02a951aa60/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index 673740b2fe..d28903e2c0 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -133,6 +133,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/25689101-012a-324a-94d3-08301e6c065a/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index 33d3416d51..0def71b595 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -101,6 +101,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/f63f7e9c-9526-11ec-9fc7-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index 6fe3533e85..48ee185ff5 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -101,6 +101,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/9b35c538-94ef-11ec-9439-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index 615d2dcfdf..cce17645b5 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -99,6 +99,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/24962154-9524-11ec-9333-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index 1feaf640e6..0e790404f5 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -96,6 +96,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/7b6c3fac-0c37-4efc-a85e-de88f42b6763/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index eb0178b685..60ef3afe0d 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -106,6 +106,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/dad9ddec-a72a-47be-87b6-a0f7ba98ed6e/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index ae29a865ef..48919e9379 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -104,6 +104,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/e102e297-dbe6-4a19-b319-5c08f4c19a06/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 2350664774..8faad63cf1 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -108,6 +108,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/477e068e-8b6d-11ec-b6c1-81af21670352/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index 35bc7ffab6..94b4e9133c 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -98,6 +98,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/d57b4d91-fc91-4482-a325-47693cced1eb/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index d4e82e30f9..9ec631daf7 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -97,6 +97,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/dc3f2af7-ca69-47ce-a122-9f9787e19417/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 8be0c3ed80..256b2b8bd4 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -102,6 +102,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/46440222-81d5-44b1-a376-19dcd70d1b08/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index bb2d2b1d8c..c8b7c99b81 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -103,6 +103,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/0bafd086-8f61-11ec-996e-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index a7cddb5dde..dd6d43416d 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -100,6 +100,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/6f42b8ce-1e15-11ec-ad5a-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index cda30f6e56..82be73ba28 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -99,6 +99,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/c842931e-661f-42bc-a4df-0460d93cfb69/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index babd2b53be..7d03e98d25 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -98,6 +98,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/ecaaf956-c516-4980-b08e-8c01c19614ca/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index 5065479ce8..17bfc90f1a 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -98,6 +98,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/3284e4f4-67f7-49b6-ad5e-a8fcead2eef8/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 0c0538b1e0..1cac13fef0 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -98,6 +98,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/e124f71f-11bc-47e4-9931-6046d256005d/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index dd67a8b2ea..fe319cc746 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -99,6 +99,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/057c06c7-ef31-4749-b5c9-199152e53a06/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 87e7ab5120..f2358ec6d7 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -98,6 +98,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/93862a89-abe0-4094-909a-08ec390aa5e3/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index 0426c83a74..ef1e91d084 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -98,6 +98,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/d75cc561-3828-4d0a-92c4-0eb93bfe0929/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 50ffb569aa..43b1096696 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -98,6 +98,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/6401d583-0052-4dc5-a713-68b510826d2b/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 77f9c00052..2eefc28540 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -98,6 +98,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/b8da7ea5-8c16-4eff-9787-54ec271159e0/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index 1e7651fca2..65e4da1048 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -94,6 +94,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/76bb9e35-f314-4c3d-a385-83c72a13ce4e/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index ec07d3990a..116c365d19 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -102,6 +102,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/0caa1dd6-94f5-11ec-9786-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 420a6cba5f..b71e7e6350 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -102,6 +102,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/92886f1c-9b11-11ec-848a-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 9a53c30b74..a99b6bee58 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -99,6 +99,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/11c32b19-05a6-48a8-ab28-18dbd9ec5d50/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index b068bf0855..1a609a9a1b 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -107,6 +107,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/0fec631a-7c9b-4e4c-b28b-93260953e25f/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index bdcc828db6..d956763832 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -110,6 +110,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/ba0c2450-caea-4086-ac3a-a71e2659754b/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index c2005b8974..5fbe18377b 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -93,6 +93,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/8d1d5570-722c-49a3-996c-2e2cceef5163/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index de9852eceb..779ebbe952 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -93,6 +93,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index 3522f3195f..e4cbcff5f8 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -93,6 +93,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/df76a8d1-92e1-4ec9-b8f7-695b5838703e/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index e08cf76841..f91979c91c 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -102,6 +102,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/76b3b290-9b31-11ec-a934-acde48001122/ + event_schema: ocsf mappings: - ocsf: process.user.name cim: user