admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

created new escu package

Browse Source
This commit is contained in:
P4T12ICK
2023-01-02 12:07:52 +01:00
parent 38eef722ea
commit bc51452711
8 changed files with 93 additions and 204 deletions
Download Patch File Download Diff File Expand all files Collapse all files
converted_detections/endpoint/hunting_for_log4shell.yml
-111
View File
@@ -1,111 +0,0 @@
name: Hunting for Log4Shell
id: 158b68fa-5d1a-11ec-aac8-acde48001122
version: 1
date: '2021-12-14'
author: Michael Haag, Splunk
status: production
type: Hunting
description: 'The following hunting query assists with quickly assessing CVE-2021-44228,
or Log4Shell, activity mapped to the Web Datamodel. This is a combination query
attempting to identify, score and dashboard. Because the Log4Shell vulnerability
requires the string to be in the logs, this will work to identify the activity anywhere
in the HTTP headers using _raw. Modify the first line to use the same pattern matching
against other log sources. Scoring is based on a simple rubric of 0-5. 5 being the
best match, and less than 5 meant to identify additional patterns that will equate
to a higher total score. \
The first jndi match identifies the standard pattern of `{jndi:` \
jndi_fastmatch is meant to identify any jndi in the logs. The score is set low and
is meant to be the "base" score used later. \
jndi_proto is a protocol match that identifies `jndi` and one of `ldap, ldaps, rmi,
dns, nis, iiop, corba, nds, http, https.` \
all_match is a very well written regex by https://gist.github.com/Schvenn that identifies
nearly all patterns of this attack behavior. \
env works to identify environment variables in the header, meant to capture `AWS_ACCESS_KEY_ID`,
`AWS_SECRET_ACCESS_KEY` and `env`. \
uri_detect is string match looking for the common uri paths currently being scanned/abused
in the wild. \
keywords matches on enumerated values that, like `$ctx:loginId`, that may be found
in the header used by the adversary. \
lookup matching is meant to catch some basic obfuscation that has been identified
using upper, lower and date. \
Scoring will then occur based on any findings. The base score is meant to be 2 ,
created by jndi_fastmatch. Everything else is meant to increase that score. \
Finally, a simple table is created to show the scoring and the _raw field. Sort
based on score or columns of interest.'
data_source: []
search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]{4}:"),4,0)
| eval jndi_fastmatch=if(match(_raw, "[jJnNdDiI]{4}"),2,0) | eval jndi_proto=if(match(_raw,"(?i)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http|https):"),5,0)
| eval all_match = if(match(_raw, "(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+"),5,0)
| eval env_var = if(match(_raw, "env:") OR match(_raw, "env:AWS_ACCESS_KEY_ID")
OR match(_raw, "env:AWS_SECRET_ACCESS_KEY"),5,0) | eval uridetect = if(match(_raw,
"(?i)Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass"),4,0)
| eval keywords = if(match(_raw,"(?i)\$\{ctx\:loginId\}|\$\{map\:type\}|\$\{filename\}|\$\{date\:MM-dd-yyyy\}|\$\{docker\:containerId\}|\$\{docker\:containerName\}|\$\{docker\:imageName\}|\$\{env\:USER\}|\$\{event\:Marker\}|\$\{mdc\:UserId\}|\$\{java\:runtime\}|\$\{java\:vm\}|\$\{java\:os\}|\$\{jndi\:logging/context-name\}|\$\{hostName\}|\$\{docker\:containerId\}|\$\{k8s\:accountName\}|\$\{k8s\:clusterName\}|\$\{k8s\:containerId\}|\$\{k8s\:containerName\}|\$\{k8s\:host\}|\$\{k8s\:labels.app\}|\$\{k8s\:labels.podTemplateHash\}|\$\{k8s\:masterUrl\}|\$\{k8s\:namespaceId\}|\$\{k8s\:namespaceName\}|\$\{k8s\:podId\}|\$\{k8s\:podIp\}|\$\{k8s\:podName\}|\$\{k8s\:imageId\}|\$\{k8s\:imageName\}|\$\{log4j\:configLocation\}|\$\{log4j\:configParentLocation\}|\$\{spring\:spring.application.name\}|\$\{main\:myString\}|\$\{main\:0\}|\$\{main\:1\}|\$\{main\:2\}|\$\{main\:3\}|\$\{main\:4\}|\$\{main\:bar\}|\$\{name\}|\$\{marker\}|\$\{marker\:name\}|\$\{spring\:profiles.active[0]|\$\{sys\:logPath\}|\$\{web\:rootDir\}|\$\{sys\:user.name\}"),4,0)
| eval obf = if(match(_raw, "(\$|%24)[^ /]*({|%7b)[^ /]*(j|%6a)[^ /]*(n|%6e)[^ /]*(d|%64)[^
/]*(i|%69)[^ /]*(:|%3a)[^ /]*(:|%3a)[^ /]*(/|%2f)"),5,0) | eval lookups = if(match(_raw,
"(?i)({|%7b)(main|sys|k8s|spring|lower|upper|env|date|sd)"),4,0) | addtotals fieldname=Score,
jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf,
lookups | where Score > 2 | stats values(Score) by jndi, jndi_proto, env_var, uridetect,
all_match, jndi_fastmatch, keywords, lookups, obf, _raw | `hunting_for_log4shell_filter`'
how_to_implement: Out of the box, the Web datamodel is required to be pre-filled.
However, tested was performed against raw httpd access logs. Change the first line
to any dataset to pass the regex's against.
known_false_positives: It is highly possible you will find false positives, however,
the base score is set to 2 for _any_ jndi found in raw logs. tune and change as
needed, include any filtering.
references:
- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
- https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b#gistcomment-3994449
- https://regex101.com/r/OSrm0q/1/
- https://github.com/Neo23x0/signature-base/blob/master/yara/expl_log4j_cve_2021_44228.yar
- https://news.sophos.com/en-us/2021/12/12/log4shell-hell-anatomy-of-an-exploit-outbreak/
- https://gist.github.com/MHaggis/1899b8554f38c8692a9fb0ceba60b44c
- https://twitter.com/sasi2103/status/1469764719850442760?s=20
tags:
analytic_story:
- Log4Shell CVE-2021-44228
- CISA AA22-320A
asset_type: Web Server
atomic_guid: []
confidence: 50
cve:
- CVE-2021-44228
drilldown_search: []
impact: 80
message: Hunting for Log4Shell exploitation has occurred.
mitre_attack_id:
- T1190
observable:
- name: dest
type: Hostname
role:
- Victim
- name: http_method
type: Other
role:
- Other
- name: src
type: Other
role:
- Other
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 40
security_domain: network
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/log4shell-nginx.log
source: /var/log/nginx/access.log
sourcetype: nginx:plus:kv
new_dist/escu/default/analyticstories.conf
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-12-22T07:31:56 UTC
# On Date: 2023-01-02T09:17:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
new_dist/escu/default/collections.conf
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-12-22T07:31:56 UTC
# On Date: 2023-01-02T09:17:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
new_dist/escu/default/es_investigations.conf
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-12-22T07:31:56 UTC
# On Date: 2023-01-02T09:17:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
new_dist/escu/default/macros.conf
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-12-22T07:31:56 UTC
# On Date: 2023-01-02T09:17:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
new_dist/escu/default/savedsearches.conf
+87 -87
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-12-22T07:31:56 UTC
# On Date: 2023-01-02T09:17:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -79,7 +79,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Risky SPL using Pretrained ML Model - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 40, "impact": 50, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 40, "cve": ["CVE-2022-32154"], "impact": 50, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -832,7 +832,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Path traversal SPL injection - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "nist": ["DE.CM"], "observable": [{"name": "clientip", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "cve": ["CVE-2022-26889"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"], "nist": ["DE.CM"], "observable": [{"name": "clientip", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -878,7 +878,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Account Discovery Drilldown Dashboard Disclosure - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"], "nist": ["DE.CM"], "observable": [{"name": "author", "role": ["Attacker"], "type": "User"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "cve": ["CVE-2022-37438"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"], "nist": ["DE.CM"], "observable": [{"name": "author", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -924,7 +924,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Code Injection via custom dashboard leading to RCE - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2022-43571"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -964,7 +964,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 30, "impact": 90, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 30, "cve": ["CVE-2022-32154"], "impact": 90, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1004,7 +1004,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 40, "impact": 50, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 40, "cve": ["CVE-2022-32154"], "impact": 50, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1044,7 +1044,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 40, "impact": 50, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 40, "cve": ["CVE-2022-32154"], "impact": 50, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1084,7 +1084,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Data exfiltration from Analytics Workspace using sid query - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Actions On Objectives"], "mitre_attack": ["T1567"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2022-43566"], "impact": 50, "kill_chain_phases": ["Actions On Objectives"], "mitre_attack": ["T1567"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1124,7 +1124,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Digital Certificates Infrastructure Version - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "impact": 50, "kill_chain_phases": ["Weaponization"], "mitre_attack": ["T1587.003"], "nist": ["DE.AE"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2022-32153"], "impact": 50, "kill_chain_phases": ["Weaponization"], "mitre_attack": ["T1587.003"], "nist": ["DE.AE"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1164,7 +1164,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Digital Certificates Lack of Encryption - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "impact": 25, "kill_chain_phases": ["Weaponization"], "mitre_attack": ["T1587.003"], "nist": ["DE.AE"], "observable": [{"name": "hostname", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "cve": ["CVE-2022-32151"], "impact": 25, "kill_chain_phases": ["Weaponization"], "mitre_attack": ["T1587.003"], "nist": ["DE.AE"], "observable": [{"name": "hostname", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1204,7 +1204,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk DoS via Malformed S2S Request - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "impact": 50, "kill_chain_phases": ["Actions On Objectives"], "mitre_attack": ["T1498"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2021-3422"], "impact": 50, "kill_chain_phases": ["Actions On Objectives"], "mitre_attack": ["T1498"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -1250,7 +1250,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Endpoint Denial of Service DoS Zip Bomb - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 75, "impact": 100, "kill_chain_phases": ["Actions On Objectives"], "mitre_attack": ["T1499"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Endpoint"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 75, "cve": ["CVE-2022-37439"], "impact": 100, "kill_chain_phases": ["Actions On Objectives"], "mitre_attack": ["T1499"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Endpoint"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -1296,7 +1296,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 70, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.AE"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2022-32157"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.AE"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1336,7 +1336,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "impact": 50, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1001.003"], "nist": ["DE.AE"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2022-32151"], "impact": 50, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1001.003"], "nist": ["DE.AE"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1376,7 +1376,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "impact": 50, "kill_chain_phases": ["Weaponization"], "mitre_attack": ["T1588.004"], "nist": ["DE.AE"], "observable": [{"name": "Hostname", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "cve": ["CVE-2022-32152"], "impact": 50, "kill_chain_phases": ["Weaponization"], "mitre_attack": ["T1588.004"], "nist": ["DE.AE"], "observable": [{"name": "Hostname", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1416,7 +1416,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "impact": 50, "kill_chain_phases": ["Weaponization"], "mitre_attack": ["T1588.004"], "nist": ["DE.AE"], "observable": [{"name": "Hostname", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "cve": ["CVE-2022-32152"], "impact": 50, "kill_chain_phases": ["Weaponization"], "mitre_attack": ["T1588.004"], "nist": ["DE.AE"], "observable": [{"name": "Hostname", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1456,7 +1456,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 90, "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.AE"], "observable": [{"name": "clientip", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 90, "cve": ["CVE-2022-43567"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.AE"], "observable": [{"name": "clientip", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1496,7 +1496,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Reflected XSS in the templates lists radio - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2022-43568"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1536,7 +1536,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Stored XSS via Data Model objectName field - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2022-43569"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -1576,7 +1576,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk User Enumeration Attempt - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "impact": 50, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078"], "nist": ["DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "cve": ["CVE-2021-33845"], "impact": 50, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078"], "nist": ["DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -1622,7 +1622,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk XSS in Monitoring Console - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 80, "cve": ["CVE-2022-27183"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -1668,7 +1668,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk XSS in Save table dialog header in search page - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "observable": [{"name": "clientip", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2022-43561"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1189"], "nist": ["DE.AE"], "observable": [{"name": "clientip", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -10101,7 +10101,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Deprecated - Open Redirect in Splunk Web - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 13"], "confidence": 50, "impact": 50, "nist": ["DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 13"], "confidence": 50, "cve": ["CVE-2016-4859"], "impact": 50, "nist": ["DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -10417,7 +10417,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Deprecated - Spectre and Meltdown Vulnerable Systems - Rule
action.correlationsearch.annotations = {"analytic_story": ["Spectre And Meltdown Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "nist": ["DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
action.correlationsearch.annotations = {"analytic_story": ["Spectre And Meltdown Vulnerabilities"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2017-5753"], "impact": 50, "nist": ["DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -10463,7 +10463,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Deprecated - Splunk Enterprise Information Disclosure - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 13"], "confidence": 50, "impact": 50, "nist": ["DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 13"], "confidence": 50, "cve": ["CVE-2018-11409"], "impact": 50, "nist": ["DE.CM"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -11685,7 +11685,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Any Powershell DownloadFile - Rule
action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Ingress Tool Transfer", "Log4Shell CVE-2021-44228", "DarkCrystal RAT"], "cis20": ["CIS 10"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Installation", "Command and Control"], "mitre_attack": ["T1059", "T1059.001", "T1105"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Ingress Tool Transfer", "Log4Shell CVE-2021-44228", "DarkCrystal RAT"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Installation", "Command and Control"], "mitre_attack": ["T1059", "T1059.001", "T1105"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -12605,7 +12605,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Child Processes of Spoolsv exe - Rule
action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Hermetic Wiper"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Hermetic Wiper"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2018-8440"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -12789,7 +12789,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - CMD Carry Out String Command Parameter - Rule
action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land", "Azorult", "DarkCrystal RAT", "ProxyNotShell", "Qakbot"], "cis20": ["CIS 10"], "confidence": 50, "impact": 60, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059.003", "T1059"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land", "Azorult", "DarkCrystal RAT", "ProxyNotShell", "Qakbot"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2021-44228"], "impact": 60, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059.003", "T1059"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -13142,7 +13142,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Control Loading from World Writable Directory - Rule
action.correlationsearch.annotations = {"analytic_story": ["Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.002"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.002"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -13642,7 +13642,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Curl Download and Bash Execution - Rule
action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "Log4Shell CVE-2021-44228", "Linux Living Off The Land"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1105"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "Log4Shell CVE-2021-44228", "Linux Living Off The Land"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1105"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -13964,7 +13964,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 - Rule
action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2021-3156"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -14010,7 +14010,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule
action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2021-3156"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -14056,7 +14056,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule
action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2021-3156"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -14102,7 +14102,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Computer Changed with Anonymous Account - Rule
action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 10"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]}
action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2020-1472"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1210"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -14146,7 +14146,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule
action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2021-36934"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -21926,7 +21926,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Java Class File download by Java User Agent - Rule
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 13"], "confidence": 50, "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "http_user_agent", "role": ["Other"], "type": "Other"}, {"name": "http_method", "role": ["Other"], "type": "Other"}]}
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 13"], "confidence": 50, "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "http_user_agent", "role": ["Other"], "type": "Other"}, {"name": "http_method", "role": ["Other"], "type": "Other"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -21972,7 +21972,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Java Writing JSP File - Rule
action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965", "Atlassian Confluence Server and Data Center CVE-2022-26134"], "cis20": ["CIS 10"], "confidence": 70, "impact": 60, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965", "Atlassian Confluence Server and Data Center CVE-2022-26134"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2022-22965"], "impact": 60, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -24268,7 +24268,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Linux Java Spawning Shell - Rule
action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Log4Shell CVE-2021-44228", "Spring4Shell CVE-2022-22965"], "cis20": ["CIS 10"], "confidence": 50, "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Log4Shell CVE-2021-44228", "Spring4Shell CVE-2022-22965"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -24755,7 +24755,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Linux pkexec Privilege Escalation - Rule
action.correlationsearch.annotations = {"analytic_story": ["Linux Privilege Escalation", "Linux Living Off The Land"], "cis20": ["CIS 10"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Linux Privilege Escalation", "Linux Living Off The Land"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2021-4034"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -27061,7 +27061,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - MSHTML Module Load in Office Product - Rule
action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -27117,7 +27117,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - MSI Module Loaded by Non-System Binary - Rule
action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Hermetic Wiper"], "cis20": ["CIS 10"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Exploitation", "Installation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.AE"], "observable": [{"name": "process_name", "role": ["Child Process"], "type": "Process Name"}]}
action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Hermetic Wiper"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2021-41379"], "impact": 80, "kill_chain_phases": ["Exploitation", "Installation"], "mitre_attack": ["T1574.002", "T1574"], "nist": ["DE.AE"], "observable": [{"name": "process_name", "role": ["Child Process"], "type": "Process Name"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -28501,7 +28501,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Office Product Writing cab or inf - Rule
action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -28547,7 +28547,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Office Spawning Control - Rule
action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -28593,7 +28593,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Outbound Network Connection from Java Using Default Ports - Rule
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 10"], "confidence": 60, "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 10"], "confidence": 60, "cve": ["CVE-2021-44228"], "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -28777,7 +28777,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - PetitPotam Network Share Access Request - Rule
action.correlationsearch.annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services"], "cis20": ["CIS 10"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1187"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2021-36942"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1187"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -28826,7 +28826,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - PetitPotam Suspicious Kerberos TGT Request - Rule
action.correlationsearch.annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services", "Active Directory Kerberos Attacks"], "cis20": ["CIS 10"], "confidence": 70, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["PetitPotam NTLM Relay on Active Directory Certificate Services", "Active Directory Kerberos Attacks"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2021-36942"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -29118,7 +29118,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - PowerShell - Connect To Internet With Hidden Window - Rule
action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group", "Log4Shell CVE-2021-44228", "AgentTesla"], "cis20": ["CIS 10"], "confidence": 90, "impact": 90, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059.001", "T1059"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Attacker"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group", "Log4Shell CVE-2021-44228", "AgentTesla"], "cis20": ["CIS 10"], "confidence": 90, "cve": ["CVE-2021-44228"], "impact": 90, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1059.001", "T1059"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Attacker"], "type": "Process"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -30110,7 +30110,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Print Spooler Adding A Printer Driver - Rule
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]}
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "cve": ["CVE-2021-34527", "CVE-2021-1675"], "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -30164,7 +30164,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Print Spooler Failed to Load a Plug-in - Rule
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "cve": ["CVE-2021-34527", "CVE-2021-1675"], "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -32027,7 +32027,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Rundll32 Control RunDLL Hunt - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"], "cis20": ["CIS 10"], "confidence": 50, "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2021-40444"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -32067,7 +32067,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Rundll32 Control RunDLL World Writable Directory - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -32383,7 +32383,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Rundll32 with no Command Line Arguments with Network - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 100, "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process Name"}]}
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2021-34527"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process Name"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -32567,7 +32567,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - SAM Database File Access Attempt - Rule
action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}, {"name": "Object_Name", "role": ["Other"], "type": "File"}]}
action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2021-36934"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}, {"name": "Object_Name", "role": ["Other"], "type": "File"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -34054,7 +34054,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Spoolsv Spawning Rundll32 - Rule
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -34100,7 +34100,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Spoolsv Suspicious Loaded Modules - Rule
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "ImageLoaded", "role": ["Other"], "type": "File"}]}
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "ImageLoaded", "role": ["Other"], "type": "File"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -34146,7 +34146,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Spoolsv Suspicious Process Access - Rule
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ProcessID", "role": ["Parent Process"], "type": "Process"}, {"name": "TargetImage", "role": ["Target"], "type": "Process Name"}]}
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ProcessID", "role": ["Parent Process"], "type": "Process"}, {"name": "TargetImage", "role": ["Target"], "type": "Process Name"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -34192,7 +34192,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Spoolsv Writing a DLL - Rule
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]}
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -34238,7 +34238,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Spoolsv Writing a DLL - Sysmon - Rule
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]}
action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 90, "cve": ["CVE-2021-34527"], "impact": 80, "kill_chain_phases": ["Installation", "Exploitation"], "mitre_attack": ["T1547.012", "T1547"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -34376,7 +34376,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Suspicious Computer Account Name Change - Rule
action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation"], "cis20": ["CIS 10"], "confidence": 70, "impact": 100, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]}
action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2021-42287", "CVE-2021-42278"], "impact": 100, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -34790,7 +34790,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Suspicious Kerberos Service Ticket Request - Rule
action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks"], "cis20": ["CIS 10"], "confidence": 60, "impact": 100, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]}
action.correlationsearch.annotations = {"analytic_story": ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks"], "cis20": ["CIS 10"], "confidence": 60, "cve": ["CVE-2021-42287", "CVE-2021-42278"], "impact": 100, "kill_chain_phases": ["Exploitation", "Delivery", "Installation"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -35593,7 +35593,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Suspicious Rundll32 no Command Line Arguments - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 10"], "confidence": 70, "cve": ["CVE-2021-34527"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -37089,7 +37089,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - W3WP Spawning Shell - Rule
action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell", "CISA AA22-257A", "ProxyNotShell", "CISA AA22-264A"], "cis20": ["CIS 10"], "confidence": 80, "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1505", "T1505.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell", "CISA AA22-257A", "ProxyNotShell", "CISA AA22-264A"], "cis20": ["CIS 10"], "confidence": 80, "cve": ["CVE-2021-34473", "CVE-2021-34523", "CVE-2021-31207"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1505", "T1505.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -37365,7 +37365,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Wget Download and Bash Execution - Rule
action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "Log4Shell CVE-2021-44228"], "cis20": ["CIS 10"], "confidence": 100, "impact": 80, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1105"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "Log4Shell CVE-2021-44228"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1105"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -39711,7 +39711,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Windows Execute Arbitrary Commands with MSDT - Rule
action.correlationsearch.annotations = {"analytic_story": ["Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], "cis20": ["CIS 10"], "confidence": 100, "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2022-30190"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -41126,7 +41126,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Windows Java Spawning Shells - Rule
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 10"], "confidence": 50, "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2021-44228"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -42560,7 +42560,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Windows Office Product Spawning MSDT - Rule
action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], "cis20": ["CIS 10"], "confidence": 100, "impact": 100, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], "cis20": ["CIS 10"], "confidence": 100, "cve": ["CVE-2022-30190"], "impact": 100, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -45618,7 +45618,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - WinRM Spawning a Process - Rule
action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2021-31166"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -46631,7 +46631,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Outbound LDAP Traffic - Rule
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 13"], "confidence": 80, "impact": 70, "kill_chain_phases": ["Delivery", "Installation"], "mitre_attack": ["T1190", "T1059"], "nist": ["DE.AE"], "observable": [{"name": "src_ip", "role": ["Victim"], "type": "IP Address"}, {"name": "dest_ip", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 13"], "confidence": 80, "cve": ["CVE-2021-44228"], "impact": 70, "kill_chain_phases": ["Delivery", "Installation"], "mitre_attack": ["T1190", "T1059"], "nist": ["DE.AE"], "observable": [{"name": "src_ip", "role": ["Victim"], "type": "IP Address"}, {"name": "dest_ip", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -46993,7 +46993,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule
action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 13"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 13"], "confidence": 50, "cve": ["CVE-2020-1350"], "impact": 50, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -47039,7 +47039,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Windows DNS SIGRed via Zeek - Rule
action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 10"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 10"], "confidence": 50, "cve": ["CVE-2020-1350"], "impact": 50, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -47085,7 +47085,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect Zerologon via Zeek - Rule
action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 13"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 13"], "confidence": 50, "cve": ["CVE-2020-1472"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -47257,7 +47257,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 - Rule
action.correlationsearch.annotations = {"analytic_story": ["F5 BIG-IP Vulnerability CVE-2022-1388"], "cis20": ["CIS 13"], "confidence": 70, "impact": 100, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["F5 BIG-IP Vulnerability CVE-2022-1388"], "cis20": ["CIS 13"], "confidence": 70, "cve": ["CVE-2022-1388"], "impact": 100, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -47816,7 +47816,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Splunk Identified SSL TLS Certificates - Rule
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 13"], "confidence": 70, "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1040"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 13"], "confidence": 70, "cve": ["CVE-2022-32151", "CVE-2022-32152"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1040"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -48022,7 +48022,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule
action.correlationsearch.annotations = {"analytic_story": ["Atlassian Confluence Server and Data Center CVE-2022-26134"], "cis20": ["CIS 13"], "confidence": 100, "impact": 100, "kill_chain_phases": ["Installation", "Delivery"], "mitre_attack": ["T1505", "T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "IP Address"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Atlassian Confluence Server and Data Center CVE-2022-26134"], "cis20": ["CIS 13"], "confidence": 100, "cve": ["CVE-2022-26134"], "impact": 100, "kill_chain_phases": ["Installation", "Delivery"], "mitre_attack": ["T1505", "T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "IP Address"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -48114,7 +48114,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule
action.correlationsearch.annotations = {"analytic_story": ["F5 TMUI RCE CVE-2020-5902"], "cis20": ["CIS 13"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
action.correlationsearch.annotations = {"analytic_story": ["F5 TMUI RCE CVE-2020-5902"], "cis20": ["CIS 13"], "confidence": 50, "cve": ["CVE-2020-5902"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Other"], "type": "Other"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -48206,7 +48206,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Exploit Public Facing Application via Apache Commons Text - Rule
action.correlationsearch.annotations = {"analytic_story": ["Text4Shell CVE-2022-42889"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Installation", "Delivery"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "IP Address"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Text4Shell CVE-2022-42889"], "cis20": ["CIS 13"], "confidence": 70, "cve": ["CVE-2022-42889"], "impact": 70, "kill_chain_phases": ["Installation", "Delivery"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "IP Address"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -48254,7 +48254,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Fortinet Appliance Auth bypass - Rule
action.correlationsearch.annotations = {"analytic_story": ["CVE-2022-40684 Fortinet Appliance Auth bypass"], "cis20": ["CIS 13"], "confidence": 90, "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["CVE-2022-40684 Fortinet Appliance Auth bypass"], "cis20": ["CIS 13"], "confidence": 90, "cve": ["CVE-2022-40684"], "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -48364,7 +48364,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Log4Shell JNDI Payload Injection Attempt - Rule
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228", "CISA AA22-257A", "CISA AA22-320A"], "cis20": ["CIS 10"], "confidence": 30, "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228", "CISA AA22-257A", "CISA AA22-320A"], "cis20": ["CIS 10"], "confidence": 30, "cve": ["CVE-2021-44228"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -48404,7 +48404,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228", "CISA AA22-320A"], "cis20": ["CIS 10"], "confidence": 30, "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228", "CISA AA22-320A"], "cis20": ["CIS 10"], "confidence": 30, "cve": ["CVE-2021-44228"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -48531,7 +48531,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Spring4Shell Payload URL Request - Rule
action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 13"], "confidence": 60, "impact": 60, "kill_chain_phases": ["Installation", "Delivery"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "IP Address"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 13"], "confidence": 60, "cve": ["CVE-2022-22965"], "impact": 60, "kill_chain_phases": ["Installation", "Delivery"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "IP Address"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -48669,7 +48669,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - VMware Server Side Template Injection Hunt - Rule
action.correlationsearch.annotations = {"analytic_story": ["VMware Server Side Injection and Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 50, "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["VMware Server Side Injection and Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 50, "cve": ["CVE-2022-22954"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -48709,7 +48709,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - VMware Workspace ONE Freemarker Server-side Template Injection - Rule
action.correlationsearch.annotations = {"analytic_story": ["VMware Server Side Injection and Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["VMware Server Side Injection and Privilege Escalation"], "cis20": ["CIS 13"], "confidence": 70, "cve": ["CVE-2022-22954"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -48749,7 +48749,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Web JSP Request via URL - Rule
action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 13"], "confidence": 80, "impact": 90, "kill_chain_phases": ["Installation", "Delivery"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 13"], "confidence": 80, "cve": ["CVE-2022-22965"], "impact": 90, "kill_chain_phases": ["Installation", "Delivery"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -48795,7 +48795,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Web Spring4Shell HTTP Request Class Module - Rule
action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 13"], "confidence": 80, "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 13"], "confidence": 80, "cve": ["CVE-2022-22965"], "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -48841,7 +48841,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Web Spring Cloud Function FunctionRouter - Rule
action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 13"], "confidence": 60, "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 13"], "confidence": 60, "cve": ["CVE-2022-22963"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -48887,7 +48887,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Windows Exchange Autodiscover SSRF Abuse - Rule
action.correlationsearch.annotations = {"analytic_story": ["ProxyShell", "ProxyNotShell"], "cis20": ["CIS 13"], "confidence": 80, "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
action.correlationsearch.annotations = {"analytic_story": ["ProxyShell", "ProxyNotShell"], "cis20": ["CIS 13"], "confidence": 80, "cve": ["CVE-2021-34523", "CVE-2021-34473", "CVE-2021-31207", "CVE-2022-41040", "CVE-2022-41082"], "impact": 90, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
new_dist/escu/default/transforms.conf
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-12-22T07:31:56 UTC
# On Date: 2023-01-02T09:17:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
new_dist/escu/default/workflow_actions.conf
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-12-22T07:31:56 UTC
# On Date: 2023-01-02T09:17:22 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############