diff --git a/detections/cloud/baseline_of_api_calls_per_user_arn.yml b/detections/deprecated/baseline_of_api_calls_per_user_arn.yml similarity index 100% rename from detections/cloud/baseline_of_api_calls_per_user_arn.yml rename to detections/deprecated/baseline_of_api_calls_per_user_arn.yml diff --git a/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/detections/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml similarity index 100% rename from detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml rename to detections/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml diff --git a/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/detections/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml similarity index 100% rename from detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml rename to detections/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml diff --git a/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml b/detections/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml similarity index 100% rename from detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml rename to detections/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml diff --git a/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml b/detections/deprecated/previously_seen_aws_provisioning_activity_sources.yml similarity index 100% rename from detections/cloud/previously_seen_aws_provisioning_activity_sources.yml rename to detections/deprecated/previously_seen_aws_provisioning_activity_sources.yml diff --git a/detections/cloud/previously_seen_ec2_amis.yml b/detections/deprecated/previously_seen_ec2_amis.yml similarity index 100% rename from detections/cloud/previously_seen_ec2_amis.yml rename to detections/deprecated/previously_seen_ec2_amis.yml diff --git a/detections/cloud/previously_seen_ec2_instance_types.yml b/detections/deprecated/previously_seen_ec2_instance_types.yml similarity index 100% rename from detections/cloud/previously_seen_ec2_instance_types.yml rename to detections/deprecated/previously_seen_ec2_instance_types.yml diff --git a/detections/cloud/previously_seen_ec2_launches_by_user.yml b/detections/deprecated/previously_seen_ec2_launches_by_user.yml similarity index 100% rename from detections/cloud/previously_seen_ec2_launches_by_user.yml rename to detections/deprecated/previously_seen_ec2_launches_by_user.yml diff --git a/detections/cloud/previously_seen_users_in_cloudtrail.yml b/detections/deprecated/previously_seen_users_in_cloudtrail.yml similarity index 100% rename from detections/cloud/previously_seen_users_in_cloudtrail.yml rename to detections/deprecated/previously_seen_users_in_cloudtrail.yml diff --git a/detections/cloud/update_previously_seen_users_in_cloudtrail.yml b/detections/deprecated/update_previously_seen_users_in_cloudtrail.yml similarity index 100% rename from detections/cloud/update_previously_seen_users_in_cloudtrail.yml rename to detections/deprecated/update_previously_seen_users_in_cloudtrail.yml diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index e246211019..90d4e076d0 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -12,10 +12,15 @@ description: This analytic identifies excessive usage of `net.exe` or `net1.exe` malicious behavior. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name - Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name + Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user + _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: unknown. Filter as needed. Modify the time span as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -60,11 +65,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 00148dc9da..6106b3e695 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -19,10 +19,15 @@ description: The following detection identifies the latest behavior utilized by search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_mshta` - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `office_product_spawning_mshta_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: No false positives known. Filter as needed. references: - https://redcanary.com/threat-detection-report/threats/TA551/ @@ -61,11 +66,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 26a0d07e05..94dde9352f 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -12,10 +12,15 @@ description: This search is to identifies a modification in registry to disable search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*" AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") - by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + by Processes.dest Processes.user Processes.parent_process Processes.original_file_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `powershell_disable_security_monitoring_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: Limited false positives. However, tune based on scripts that may perform this action. references: @@ -39,11 +44,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path