Merge pull request #1721 from splunk/CARS_UPDATE_MITRE_ID_B3

Cars update mitre id b3

detections/endpoint/7zip_commandline_to_smb_share_path.yml

@@ -44,6 +44,7 @@ tags:
     $dest$
   mitre_attack_id:
   - T1560.001
+  - T1560
   observable:
   - name: dest
     type: Hostname

detections/endpoint/access_lsass_memory_for_dump_creation.yml

@@ -43,6 +43,7 @@ tags:
     Service (LSASS).
   mitre_attack_id:
   - T1003.001
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/account_discovery_with_net_app.yml

@@ -47,6 +47,7 @@ tags:
   message: Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1087.002
+  - T1087
   observable:
   - name: user
     type: User

detections/endpoint/active_setup_registry_autostart.yml

@@ -19,9 +19,9 @@ search: '| tstats `security_content_summariesonly` count  min(_time) as firstTim
   Components*" by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name
   Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting
-  data that records registry activity from your hosts to populate the endpoint data
-  model in the registry node. This is typically populated via endpoint detection-and-response
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
   product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
   used for this search is typically generated via logs that report reads and writes
   to the registry.
@@ -39,6 +39,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1547.014
+  - T1547
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/add_defaultuser_and_password_in_registry.yml

@@ -42,6 +42,7 @@ tags:
     to prepare autoadminlogon
   mitre_attack_id:
   - T1552.002
+  - T1552
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/adsisearcher_account_discovery.yml

@@ -38,6 +38,7 @@ tags:
   message: powershell process having commandline $Message$ for user enumeration
   mitre_attack_id:
   - T1087.002
+  - T1087
   observable:
   - name: ComputerName
     type: Hostname

detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml

@@ -36,6 +36,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1562.007
+  - T1562
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -42,6 +42,7 @@ tags:
     $dest$ by user $user$.
   mitre_attack_id:
   - T1021.001
+  - T1021
   observable:
   - name: user
     type: User

detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml

@@ -38,6 +38,7 @@ tags:
     user $user$.
   mitre_attack_id:
   - T1021.001
+  - T1021
   observable:
   - name: user
     type: User

detections/endpoint/allow_network_discovery_in_firewall.yml

@@ -38,6 +38,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1562.007
+  - T1562
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/anomalous_usage_of_7zip.yml

@@ -47,6 +47,7 @@ tags:
     of 7zip.
   mitre_attack_id:
   - T1560.001
+  - T1560
   observable:
   - name: user
     type: User

detections/endpoint/any_powershell_downloadfile.yml

@@ -47,6 +47,7 @@ tags:
     on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile
     within PowerShell.
   mitre_attack_id:
+  - T1059
   - T1059.001
   observable:
   - name: user

detections/endpoint/any_powershell_downloadstring.yml

@@ -44,6 +44,7 @@ tags:
     on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString
     within PowerShell.
   mitre_attack_id:
+  - T1059
   - T1059.001
   observable:
   - name: user

detections/endpoint/attacker_tools_on_endpoint.yml

@@ -51,8 +51,9 @@ tags:
     on host $dest$ by User $user$. This process $process_name$ is known to do- $description$
   mitre_attack_id:
   - T1036.005
-  - T1595
+  - T1036
   - T1003
+  - T1595
   nist:
   - ID.AM
   - PR.DS

detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml

@@ -46,6 +46,7 @@ tags:
     attempting to add a certificate to the store on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1553.004
+  - T1553
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/attempt_to_stop_security_service.yml

@@ -49,6 +49,7 @@ tags:
     attempting to disable security services on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1562.001
+  - T1562
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -47,6 +47,7 @@ tags:
     on endpoint $dest$ by user $user$ attempting to export the registry keys.
   mitre_attack_id:
   - T1003.002
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/auto_admin_logon_registry_entry.yml

@@ -42,6 +42,7 @@ tags:
     to prepare autoadminlogon
   mitre_attack_id:
   - T1552.002
+  - T1552
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/batch_file_write_to_system32.yml

@@ -50,6 +50,7 @@ tags:
   message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$
     by user $user$.
   mitre_attack_id:
+  - T1204
   - T1204.002
   nist:
   - PR.PT

detections/endpoint/change_default_file_association.yml

@@ -36,6 +36,7 @@ tags:
   - Exploitation
   mitre_attack_id:
   - T1546.001
+  - T1546
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/clear_unallocated_sector_using_cipher_app.yml

@@ -40,6 +40,7 @@ tags:
     of a specific disk.
   mitre_attack_id:
   - T1070.004
+  - T1070
   observable:
   - name: user
     type: User

detections/endpoint/cmd_echo_pipe___escalation.yml

@@ -44,8 +44,10 @@ tags:
     on endpoint $dest$ by user $user$ potentially performing privilege escalation
     using named pipes related to Cobalt Strike and other frameworks.
   mitre_attack_id:
+  - T1059
   - T1059.003
   - T1543.003
+  - T1543
   observable:
   - name: user
     type: User

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -44,6 +44,7 @@ tags:
   message: parent process name $parent_process_name$ with child process $process_name$
     to execute commandline tool in $dest$
   mitre_attack_id:
+  - T1059
   - T1059.007
   observable:
   - name: dest

detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml

@@ -38,6 +38,7 @@ tags:
   message: The following module $ImageLoaded$ was loaded by a non-standard application
     on endpoint $Computer$ by user $user$.
   mitre_attack_id:
+  - T1218
   - T1218.003
   observable:
   - name: user

detections/endpoint/control_loading_from_world_writable_directory.yml

@@ -47,6 +47,7 @@ tags:
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
   mitre_attack_id:
+  - T1218
   - T1218.002
   observable:
   - name: user

detections/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -46,6 +46,7 @@ tags:
     group.
   mitre_attack_id:
   - T1136.001
+  - T1136
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml

@@ -42,6 +42,7 @@ tags:
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ enumerating Windows file shares.
   mitre_attack_id:
+  - T1070
   - T1070.005
   nist:
   - PR.PT

detections/endpoint/create_remote_thread_into_lsass.yml

@@ -41,6 +41,7 @@ tags:
     behavior is indicative of credential dumping and should be investigated.
   mitre_attack_id:
   - T1003.001
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/create_service_in_suspicious_file_path.yml

@@ -36,6 +36,7 @@ tags:
   message: A service $Service_File_Name$ was created from a non-standard path using
     $Service_Name$, potentially leading to a privilege escalation.
   mitre_attack_id:
+  - T1569
   - T1569.002
   observable:
   - name: Service_File_Name

detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml

@@ -47,6 +47,7 @@ tags:
     to disk. This behavior is related to dumping credentials via Task Manager.
   mitre_attack_id:
   - T1003.001
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/creation_of_shadow_copy.yml

@@ -45,6 +45,7 @@ tags:
     offline password cracking.
   mitre_attack_id:
   - T1003.003
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml

@@ -43,6 +43,7 @@ tags:
     offline password cracking.
   mitre_attack_id:
   - T1003.003
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml

@@ -45,6 +45,7 @@ tags:
     password cracking.
   mitre_attack_id:
   - T1003.003
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml

@@ -43,6 +43,7 @@ tags:
     to grab credentials.
   mitre_attack_id:
   - T1003.003
+  - T1003
   nist:
   - DE.CM
   observable:

detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml

@@ -38,6 +38,7 @@ tags:
   message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type
     3, which may be indicative of the pass the hash technique.
   mitre_attack_id:
+  - T1550
   - T1550.002
   nist:
   - PR.PT

detections/endpoint/detect_azurehound_command_line_arguments.yml

@@ -42,10 +42,12 @@ tags:
     on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD.
   mitre_attack_id:
   - T1087.002
-  - T1087.001
-  - T1482
-  - T1069.002
   - T1069.001
+  - T1482
+  - T1087.001
+  - T1087
+  - T1069.002
+  - T1069
   observable:
   - name: user
     type: User

detections/endpoint/detect_azurehound_file_modifications.yml

@@ -45,10 +45,12 @@ tags:
     a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$.
   mitre_attack_id:
   - T1087.002
-  - T1087.001
-  - T1482
-  - T1069.002
   - T1069.001
+  - T1482
+  - T1087.001
+  - T1087
+  - T1069.002
+  - T1069
   observable:
   - name: user
     type: User

detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml

@@ -49,6 +49,7 @@ tags:
     $ComputerName$ by user $user$.
   mitre_attack_id:
   - T1003.002
+  - T1003
   observable:
   - name: user
     type: User

detections/endpoint/detect_credential_dumping_through_lsass_access.yml

@@ -47,6 +47,7 @@ tags:
     investigated.
   mitre_attack_id:
   - T1003.001
+  - T1003
   nist:
   - PR.IP
   - PR.AC

detections/endpoint/detect_empire_with_powershell_script_block_logging.yml

@@ -51,6 +51,7 @@ tags:
   message: The following behavior was identified and typically related to PowerShell-Empire
     on $ComputerName$ by $User$.
   mitre_attack_id:
+  - T1059
   - T1059.001
   observable:
   - name: User

detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml

@@ -49,6 +49,7 @@ tags:
   message: Multiple accounts have been locked out. Review $dest$ and results related
     to $user$.
   mitre_attack_id:
+  - T1078
   - T1078.002
   nist:
   - PR.IP

detections/endpoint/detect_excessive_user_account_lockouts.yml

@@ -38,6 +38,7 @@ tags:
   message: Multiple accounts have been locked out. Review $nodename$ and $result$
     related to $user$.
   mitre_attack_id:
+  - T1078
   - T1078.003
   nist:
   - PR.IP

detections/endpoint/detect_exchange_web_shell.yml

@@ -65,6 +65,7 @@ tags:
     previously performed by HAFNIUM. Review further file modifications on endpoint
     $dest$ by user $user$.
   mitre_attack_id:
+  - T1505
   - T1505.003
   observable:
   - name: user

detections/endpoint/detect_html_help_renamed.yml

@@ -53,6 +53,7 @@ tags:
   message: The following $process_name$ has been identified as renamed, spawning from
     $parent_process_name$.
   mitre_attack_id:
+  - T1218
   - T1218.001
   nist:
   - PR.PT

detections/endpoint/detect_html_help_spawn_child_process.yml

@@ -53,6 +53,7 @@ tags:
     on endpoint $dest$ by user $user$ spawning a child process, typically not normal
     behavior.
   mitre_attack_id:
+  - T1218
   - T1218.001
   nist:
   - PR.PT

detections/endpoint/detect_html_help_url_in_command_line.yml

@@ -57,6 +57,7 @@ tags:
     on endpoint $dest$ by user $user$ contacting a remote destination to potentally
     download a malicious payload.
   mitre_attack_id:
+  - T1218
   - T1218.001
   nist:
   - PR.PT

detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml

@@ -58,6 +58,7 @@ tags:
   message: $process_name$ has been identified using Infotech Storage Handlers to load
     a specific file within a CHM on $dest$ under user $user$.
   mitre_attack_id:
+  - T1218
   - T1218.001
   nist:
   - PR.PT

detections/endpoint/detect_mimikatz_using_loaded_images.yml

@@ -48,6 +48,7 @@ tags:
     to credential dumping on $Computer$. Review for further details.
   mitre_attack_id:
   - T1003.001
+  - T1003
   nist:
   - DE.AE
   - DE.CM

detections/endpoint/detect_mshta_inline_hta_execution.yml

@@ -49,6 +49,7 @@ tags:
     on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense
     evasion.
   mitre_attack_id:
+  - T1218
   - T1218.005
   nist:
   - PR.PT

detections/endpoint/detect_mshta_renamed.yml

@@ -46,6 +46,7 @@ tags:
   message: The following $process_name$ has been identified as renamed, spawning from
     $parent_process_name$.
   mitre_attack_id:
+  - T1218
   - T1218.005
   nist:
   - PR.PT

detections/endpoint/detect_mshta_url_in_command_line.yml

@@ -50,6 +50,7 @@ tags:
     on endpoint $est$ by user $user$ attempting to access a remote destination to
     download an additional payload.
   mitre_attack_id:
+  - T1218
   - T1218.005
   nist:
   - PR.PT

detections/endpoint/detect_new_local_admin_account.yml

@@ -42,6 +42,7 @@ tags:
     behavior or not.
   mitre_attack_id:
   - T1136.001
+  - T1136
   nist:
   - PR.AC
   - DE.CM

detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml

@@ -45,6 +45,7 @@ tags:
     using unquoted service paths.
   mitre_attack_id:
   - T1574.009
+  - T1574
   nist:
   - PR.PT
   - DE.CM

detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml

@@ -48,6 +48,7 @@ tags:
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ running prohibited applications.
   mitre_attack_id:
+  - T1059
   - T1059.003
   nist:
   - PR.PT

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -53,6 +53,7 @@ tags:
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
     on endpoint $dest$ by user $user$ running the utility for possibly the first time.
   mitre_attack_id:
+  - T1021
   - T1021.002
   nist:
   - PR.PT

detections/endpoint/detect_regasm_spawning_a_process.yml

@@ -50,6 +50,7 @@ tags:
     on endpoint $dest$ by user $user$ spawning a child process, typically not normal
     behavior for $parent_process_name$.
   mitre_attack_id:
+  - T1218
   - T1218.009
   nist:
   - PR.PT

detections/endpoint/detect_regasm_with_network_connection.yml

@@ -49,6 +49,7 @@ tags:
   message: An instance of $process_name$ contacting a remote destination was identified
     on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
   mitre_attack_id:
+  - T1218
   - T1218.009
   nist:
   - PR.PT

detections/endpoint/detect_regasm_with_no_command_line_arguments.yml

@@ -48,6 +48,7 @@ tags:
   message: The process $process_name$ was spawned by $parent_process_name$ without
     any command-line arguments on $dest$ by $user$.
   mitre_attack_id:
+  - T1218
   - T1218.009
   nist:
   - PR.PT

detections/endpoint/detect_regsvcs_spawning_a_process.yml

@@ -48,6 +48,7 @@ tags:
   message: An instance of $parent_process_name$ spawning $process_name$  was identified
     on endpoint $dest$ by user $user$ typically not normal for this process.
   mitre_attack_id:
+  - T1218
   - T1218.009
   nist:
   - PR.PT

detections/endpoint/detect_regsvcs_with_network_connection.yml

@@ -49,6 +49,7 @@ tags:
   message: An instance of $process_name$ contacting a remote destination was identified
     on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
   mitre_attack_id:
+  - T1218
   - T1218.009
   nist:
   - PR.PT