diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py index 4afa6702cc..89a5ad5e02 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py @@ -38,6 +38,7 @@ class DetectionTags(BaseModel): observable_str: str = None kill_chain_phases_id: list = None research_site_url: str = None + event_schema: str = None @validator('cis20') diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index bda2fb25d6..a2e9ab02cf 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -35,6 +35,9 @@ class ObjToYmlAdapter(Adapter): research_site_url = RESEARCH_SITE_BASE + obj.source + "/" + obj.id + "/" obj.tags.research_site_url = research_site_url + # add ocsf schema tag + obj.tags.event_schema = 'cim' + body = FindingReportObject.writeFindingReport(obj) # remove unncessary fields @@ -60,7 +63,8 @@ class ObjToYmlAdapter(Adapter): "risk_score": True, "security_domain": True, "required_fields": True, - "research_site_url": True + "research_site_url": True, + "event_schema": True }, "test": { diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml index 2098cad653..97e7ac5fb8 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -54,6 +54,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/ + event_schema: cim test: name: Anomalous usage of Archive Tools Unit Test tests: diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index ef21f81a22..3951109d62 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -48,6 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/ + event_schema: cim test: name: Anomalous usage of Archive Tools Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index b97e58523b..2b8bbf2856 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -56,6 +56,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/a0c8c292-d01a-11eb-aa18-acde48001122/ + event_schema: cim test: name: Attempt To Delete Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index 91351c5140..21b2c3cef4 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -55,6 +55,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/afb31de4-d023-11eb-98d5-acde48001122/ + event_schema: cim test: name: Attempt To Disable Services Unit Test tests: diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 55124fcc46..86c11c526c 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -51,6 +51,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/ + event_schema: cim test: name: Attempted Credential Dump From Registry via Reg exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 2d5a4daffb..b02663de71 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -49,6 +49,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13/ + event_schema: cim test: name: BCDEdit Failure Recovery Modification Unit Test tests: diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 723fb37720..a92f58b8a3 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -55,6 +55,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/8f907d90-6173-11ec-9c23-acde48001122/ + event_schema: cim test: name: Clear Unallocated Sector Using Cipher - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 17c5a937c6..37c2168452 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -54,6 +54,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/8776d79c-d26e-11eb-9a56-acde48001122/ + event_schema: cim test: name: Delete A Net User Unit Test tests: diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 7b1b3db5de..8515307f95 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -52,6 +52,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/b76eae28-cd25-11eb-9c92-acde48001122/ + event_schema: cim test: name: Deny Permission using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 55ea07ea07..adb3125d68 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -54,6 +54,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd80-4ffa-a844-25026e0a0c94/ + event_schema: cim test: name: Detect Prohibited Applications Spawning cmd exe Unit Test tests: diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index 7baacb920d..b135da3cef 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -59,6 +59,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/e8b74268-5454-11ec-a799-acde48001122/ + event_schema: cim test: name: Detect RClone Command-Line Usage Unit Test tests: diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index 90fcf77928..556eb62bef 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -55,6 +55,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/ba858b08-d26c-11eb-af9b-acde48001122/ + event_schema: cim test: name: Disable Net User Account Unit Test tests: diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index 98a1f181e7..ed7dad7af8 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -55,6 +55,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/2452e632-9e0d-11eb-34ba-acde48001122/ + event_schema: cim test: name: DNS Exfiltration Using Nslookup App Unit Test tests: diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index 24876e8841..8209ee9d9f 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -49,6 +49,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/f792cdc9-43ee-4429-a3c0-ffce4fed1a85/ + event_schema: cim test: name: Fsutil Zeroing File Unit Test tests: diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index bc15802fc1..809e5c24fb 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -52,6 +52,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/c6da561a-cd29-11eb-ae65-acde48001122/ + event_schema: cim test: name: Grant Permission Using Cacls Utility Unit Test tests: diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index 44a0c11d93..99b10e933d 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -49,6 +49,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/028e4406-6176-11ec-aec2-acde48001122/ + event_schema: cim test: name: Hiding Files And Directories With Attrib exe - SSA Unit test tests: diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index 7527d8b6fb..6c619d22d2 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -55,6 +55,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/9ae9a48a-cdbe-11eb-875a-acde48001122/ + event_schema: cim test: name: Modify ACLs Permission Of Files Or Folders Unit Test tests: diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index e865a128fb..2fb9f08374 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -54,6 +54,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/dbc30554-d27e-11eb-9e5e-acde48001122/ + event_schema: cim test: name: Resize Shadowstorage Volume Unit Test tests: diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index bd10fa95d5..0d69df7634 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -64,6 +64,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/ + event_schema: cim test: name: Sdelete Application Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index ceaf466082..9275c01a89 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -250,6 +250,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/28179107-099a-464a-94d3-08301e6c055f/ + event_schema: cim test: name: System Process Running from Unexpected Location Unit Test tests: diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 6fa1179c6e..63d39d6577 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -52,6 +52,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/71efbf52-4dbb-4c00-a520-306aa546cbb7/ + event_schema: cim test: name: WBAdmin Delete System Backups Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index cbb9303b7b..95d6c76585 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/5438113c-cdd9-11eb-93b8-acde48001122/ + event_schema: cim test: name: WevtUtil Usage To Clear Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 793f4a5bb2..07423e26d1 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -54,6 +54,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/a4bdc944-cdd9-11eb-ac97-acde48001122/ + event_schema: cim test: name: Wevtutil Usage To Disable Logs Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index abee8d7d9f..5c7af5b92e 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -59,6 +59,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/1e25e97a-8ea4-11ec-9767-acde48001122/ + event_schema: cim test: name: Windows Bits Job Persistence Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index c19ba4c5bf..2946b8ccf7 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -66,6 +66,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/d76e8188-8f5a-11ec-ace4-acde48001122/ + event_schema: cim test: name: Windows Bitsadmin Download File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index c95b23c276..719689ca7a 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -60,6 +60,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/b06983f4-8f72-11ec-ab50-acde48001122/ + event_schema: cim test: name: Windows CertUtil Decode File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index 1b1445dda9..5216c26024 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -57,6 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/8cb1ad38-8f6d-11ec-87a3-acde48001122/ + event_schema: cim test: name: Windows CertUtil URLCache Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index a2aa277852..b6a47b60f8 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/9ac29c40-8f6b-11ec-b19a-acde48001122/ + event_schema: cim test: name: Windows CertUtil VerifyCtl Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 54d3163ba8..10e8d46901 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -67,6 +67,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/cc8d046a-543b-11ec-b864-acde48001122/ + event_schema: cim test: name: Windows Curl Upload to Remote Destination Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 9b2b8918ab..9d87d3a58e 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -46,6 +46,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/c205bd2e-cd5b-4224-8510-578a2a1f83d7/ + event_schema: cim test: name: Windows Defender Tools in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index e3b3f5e002..90d2334b95 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -51,6 +51,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/aa502688-9037-11ec-842d-acde48001122/ + event_schema: cim test: name: BA Windows Diskshadow Proxy Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index 0725a19f4f..f395c33bb2 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -78,6 +78,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/21179107-099a-324a-94d3-08301e6c065f/ + event_schema: cim test: name: Windows DotNet Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml index 2e538f0486..675863574e 100644 --- a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml +++ b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml @@ -60,6 +60,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/66adff66-90d9-11ec-aba7-acde48001122/ + event_schema: cim test: name: Windows Eventvwr UAC Bypass Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index ab8dbda383..d879885f2f 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -62,6 +62,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/f253f9c2-10f0-4cc8-b469-f505ba8c2038/ + event_schema: cim test: name: Windows Execute Arbitrary Commands with MSDT Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index 82711dd489..87af261043 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -56,6 +56,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/695bfad6-9662-4f9e-a576-bf02a951aa60/ + event_schema: cim test: name: Windows Ingress Tool Transfer Using Explorer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index f0428a0b28..9720a34aa8 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -88,6 +88,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/25689101-012a-324a-94d3-08301e6c065a/ + event_schema: cim test: name: Windows LOLBin Binary in Non Standard Path Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index ad74833f85..1d3ee91916 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -57,6 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/f63f7e9c-9526-11ec-9fc7-acde48001122/ + event_schema: cim test: name: Windows MSHTA Child Process Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index cdf152b32b..bdf9b4f10b 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -59,6 +59,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/9b35c538-94ef-11ec-9439-acde48001122/ + event_schema: cim test: name: Windows MSHTA Command-Line URL Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index 902ff24976..e513a24364 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -57,6 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/24962154-9524-11ec-9333-acde48001122/ + event_schema: cim test: name: Windows MSHTA Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index a3f28966b7..aeb7821ec3 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -56,6 +56,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/7b6c3fac-0c37-4efc-a85e-de88f42b6763/ + event_schema: cim test: name: Windows Odbcconf Load Response File Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 2ee634c347..e68bce816f 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -61,6 +61,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/dad9ddec-a72a-47be-87b6-a0f7ba98ed6e/ + event_schema: cim test: name: Windows OS Credential Dumping with Ntdsutil Export NTDS Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index 5baa10def5..67b3121615 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/e102e297-dbe6-4a19-b319-5c08f4c19a06/ + event_schema: cim test: name: Windows OS Credential Dumping with Procdump Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index b26ef34d3c..233d0cd9fb 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -65,6 +65,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/477e068e-8b6d-11ec-b6c1-81af21670352/ + event_schema: cim test: name: Windows Powershell Connect to Internet With Hidden Window Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 783ee2a239..4b2fd1b8b7 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -59,6 +59,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/46440222-81d5-44b1-a376-19dcd70d1b08/ + event_schema: cim test: name: Windows Powershell DownloadFile Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index ac16322b40..9b3a01fee9 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/0bafd086-8f61-11ec-996e-acde48001122/ + event_schema: cim test: name: Windows PowerShell Start-BitsTransfer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 0042ab9b8b..fe0fd6fcb9 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/6f42b8ce-1e15-11ec-ad5a-acde48001122/ + event_schema: cim test: name: Windows Rasautou DLL Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index dade0a7c34..d3bc032cd3 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -46,6 +46,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/76bb9e35-f314-4c3d-a385-83c72a13ce4e/ + event_schema: cim test: name: Windows Rundll32 Comsvcs Memory Dump Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index cb18a878e5..aba7137395 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -60,6 +60,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/0caa1dd6-94f5-11ec-9786-acde48001122/ + event_schema: cim test: name: Windows Rundll32 Inline HTA Execution Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 07f64c8c90..c805603cf1 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -57,6 +57,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/92886f1c-9b11-11ec-848a-acde48001122/ + event_schema: cim test: name: Windows Script Host Spawn MSBuild Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 6e7e5a60bd..0462226179 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/11c32b19-05a6-48a8-ab28-18dbd9ec5d50/ + event_schema: cim test: name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index fa03eca60d..46d1a88a92 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -65,6 +65,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/0fec631a-7c9b-4e4c-b28b-93260953e25f/ + event_schema: cim test: name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line Unit Test diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index a00b77cc59..761e9549da 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -68,6 +68,7 @@ tags: security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/ba0c2450-caea-4086-ac3a-a71e2659754b/ + event_schema: cim test: name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers Unit Test diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index 7d8c7f0b1f..e82961dfdd 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -48,6 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/8d1d5570-722c-49a3-996c-2e2cceef5163/ + event_schema: cim test: name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 1cb8e6a1f6..df4da75e69 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -48,6 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5/ + event_schema: cim test: name: Windows System Binary Proxy Execution MSIExec Remote Download Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index 488030cdcc..df8bf50173 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -48,6 +48,7 @@ tags: security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/df76a8d1-92e1-4ec9-b8f7-695b5838703e/ + event_schema: cim test: name: Windows System Binary Proxy Execution MSIExec Unregister DLL Unit Test tests: diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index ca34125c3a..659fd6da92 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -58,6 +58,7 @@ tags: security_domain: endpoint risk_severity: high research_site_url: https://research.splunk.com/endpoint/76b3b290-9b31-11ec-a934-acde48001122/ + event_schema: cim test: name: Windows WMIPrvse Spawn MSBuild Unit Test tests: