diff --git a/detections/deprecated/open_redirect_in_splunk_web.yml b/detections/deprecated/open_redirect_in_splunk_web.yml index 5a2bb550d4..3f90e43fee 100644 --- a/detections/deprecated/open_redirect_in_splunk_web.yml +++ b/detections/deprecated/open_redirect_in_splunk_web.yml @@ -35,3 +35,5 @@ tags: required_fields: - _time security_domain: network + cve: + - CVE-2016-4859 diff --git a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml b/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml index f74d178fc5..a52bcc922c 100644 --- a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml +++ b/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml @@ -36,3 +36,5 @@ tags: required_fields: - _time security_domain: endpoint + cve: + - CVE-2017-5753 diff --git a/detections/deprecated/splunk_enterprise_information_disclosure.yml b/detections/deprecated/splunk_enterprise_information_disclosure.yml index 224b287aac..241cafed77 100644 --- a/detections/deprecated/splunk_enterprise_information_disclosure.yml +++ b/detections/deprecated/splunk_enterprise_information_disclosure.yml @@ -42,3 +42,6 @@ tags: required_fields: - _time security_domain: network + cve: + - CVE-2018-11409 + \ No newline at end of file diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 050e6a3f9d..489d0562f5 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + cve: + - CVE-2021-40444 diff --git a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml index bc4caa31bd..feba1f1c3c 100644 --- a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml +++ b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml @@ -67,3 +67,5 @@ tags: - user risk_score: 49 security_domain: endpoint + cve: + - CVE-2020-1472 diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml index d767e38a31..39d8524d99 100644 --- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml +++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml @@ -72,3 +72,5 @@ tags: - EventCode risk_score: 80 security_domain: endpoint + cve: + - CVE-2021-36934 diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index 3f69b6ceb5..21c632bd2d 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -69,3 +69,5 @@ tags: - dest risk_score: 80 security_domain: endpoint + cve: + - CVE-2021-40444 diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index 9716d778fc..460a047cf7 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -74,3 +74,5 @@ tags: - file_path risk_score: 80 security_domain: endpoint + cve: + - CVE-2021-40444 diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml index c1a024ed2b..93a0806619 100644 --- a/detections/endpoint/office_spawning_control.yml +++ b/detections/endpoint/office_spawning_control.yml @@ -83,3 +83,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + cve: + - CVE-2021-40444 diff --git a/detections/endpoint/petitpotam_network_share_access_request.yml b/detections/endpoint/petitpotam_network_share_access_request.yml index ad3efe3105..891484462b 100644 --- a/detections/endpoint/petitpotam_network_share_access_request.yml +++ b/detections/endpoint/petitpotam_network_share_access_request.yml @@ -68,3 +68,5 @@ tags: - Message risk_score: 56 security_domain: endpoint + cve: + - CVE-2021-36942 diff --git a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml index 754283e677..71f1992f4e 100644 --- a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml +++ b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml @@ -61,3 +61,5 @@ tags: - Message risk_score: 56 security_domain: endpoint + cve: + - CVE-2021-36942 diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index d65fc252fd..bf81bbacc7 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -68,3 +68,6 @@ tags: - Message risk_score: 72 security_domain: endpoint + cve: + - CVE-2021-34527 + - CVE-2021-1675 diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 919bc479cc..dde5673980 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -66,3 +66,6 @@ tags: - Message risk_score: 72 security_domain: endpoint + cve: + - CVE-2021-34527 + - CVE-2021-1675 diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index 0007a75412..729d332e68 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -87,3 +87,5 @@ tags: - Processes.parent_process_id risk_score: 15 security_domain: endpoint + cve: + - CVE-2021-40444 diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index 3acd837f63..e0eaf9c6a5 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -89,3 +89,5 @@ tags: - Processes.parent_process_id risk_score: 80 security_domain: endpoint + cve: + - CVE-2021-40444 diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 534dd81817..e4a89c0c12 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -84,3 +84,5 @@ tags: - Processes.parent_process_id risk_score: 70 security_domain: endpoint + cve: + - CVE-2021-34527 diff --git a/detections/endpoint/sam_database_file_access_attempt.yml b/detections/endpoint/sam_database_file_access_attempt.yml index a082dff66f..e12ec38401 100644 --- a/detections/endpoint/sam_database_file_access_attempt.yml +++ b/detections/endpoint/sam_database_file_access_attempt.yml @@ -72,3 +72,5 @@ tags: - user risk_score: 80 security_domain: endpoint + cve: + - CVE-2021-36934 diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index d60fa4a4f2..d995126132 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -82,3 +82,5 @@ tags: - Processes.parent_process_id risk_score: 72 security_domain: endpoint + cve: + - CVE-2021-34527 diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 85a54dbaed..24908328a7 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -66,3 +66,5 @@ tags: - ImageLoaded risk_score: 72 security_domain: endpoint + cve: + - CVE-2021-34527 diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index 041b34c2f5..bb33be8839 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -71,3 +71,5 @@ tags: - EventCode risk_score: 72 security_domain: endpoint + cve: + - CVE-2021-34527 diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index cf7150056b..4fa0647de8 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -79,3 +79,5 @@ tags: - Processes.dest risk_score: 72 security_domain: endpoint + cve: + - CVE-2021-34527 diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index 540559a44a..b1b6b5d50e 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -73,3 +73,5 @@ tags: - TargetFilename risk_score: 72 security_domain: endpoint + cve: + - CVE-2021-34527 diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index 683ac299ac..c6d968468d 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -85,3 +85,5 @@ tags: - Processes.parent_process_id risk_score: 49 security_domain: endpoint + cve: + - CVE-2021-34527 diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml index 4bd73fe7b8..8c047e1361 100644 --- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml +++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml @@ -69,3 +69,5 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + cve: + - CVE-2021-26857 diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 726c79d82d..f3cd843d81 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -76,3 +76,7 @@ tags: - Processes.parent_process_id risk_score: 56 security_domain: endpoint + cve: + - CVE-2021-34473 + - CVE-2021-34523 + - CVE-2021-31207 diff --git a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml index d678e09d43..f414917108 100644 --- a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml @@ -54,3 +54,5 @@ tags: - Processes.parent_process - Processes.user security_domain: endpoint + cve: + - CVE-2018-8440 diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml index 249358cf24..f5fd6c6dc7 100644 --- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml +++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml @@ -35,3 +35,5 @@ tags: required_fields: - _time security_domain: endpoint + cve: + - CVE-2021-3156 diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml index 68efb44480..ad5339f8c5 100644 --- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml +++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml @@ -39,3 +39,5 @@ tags: - _time - host security_domain: endpoint + cve: + - CVE-2021-3156 diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml index 6d8ee4915e..d73bab1f31 100644 --- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml +++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml @@ -36,3 +36,5 @@ tags: - _time - columns.cmdline security_domain: endpoint + cve: + - CVE-2021-3156 diff --git a/detections/experimental/endpoint/winrm_spawning_a_process.yml b/detections/experimental/endpoint/winrm_spawning_a_process.yml index f058786ecd..3af91c1a78 100644 --- a/detections/experimental/endpoint/winrm_spawning_a_process.yml +++ b/detections/experimental/endpoint/winrm_spawning_a_process.yml @@ -51,3 +51,5 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + cve: + - CVE-2021-31166 diff --git a/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml index 0e09903e82..1637b2744d 100644 --- a/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml +++ b/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml @@ -37,3 +37,5 @@ tags: required_fields: - _time security_domain: network + cve: + - CVE-2020-1350 diff --git a/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml b/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml index 7cc63741fc..30b98c88c6 100644 --- a/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml +++ b/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml @@ -44,3 +44,5 @@ tags: - All_Traffic.bytes_in - All_Traffic.flow_id security_domain: endpoint + cve: + - CVE-2020-1350 diff --git a/detections/experimental/network/detect_zerologon_via_zeek.yml b/detections/experimental/network/detect_zerologon_via_zeek.yml index 156c81236a..72c5dc161f 100644 --- a/detections/experimental/network/detect_zerologon_via_zeek.yml +++ b/detections/experimental/network/detect_zerologon_via_zeek.yml @@ -42,3 +42,5 @@ tags: - _time - operation security_domain: network + cve: + - CVE-2020-1472 diff --git a/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml b/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml index c59807a6b5..59849868b6 100644 --- a/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml +++ b/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml @@ -40,3 +40,5 @@ tags: required_fields: - _time security_domain: network + cve: + - CVE-2020-5902 diff --git a/detections/network/investigate_network_traffic_from_src_ip.yml b/detections/network/investigate_network_traffic_from_src_ip.yml index 38281825d4..e8ab88a24d 100644 --- a/detections/network/investigate_network_traffic_from_src_ip.yml +++ b/detections/network/investigate_network_traffic_from_src_ip.yml @@ -23,3 +23,5 @@ tags: - _time - src_ip security_domain: network + cve: + - CVE-2018-11409